Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.
CVSS Information
N/A
Vulnerability Type
不完整的黑名单
Vulnerability Title
FasterXML Jackson-databind 代码问题漏洞
Vulnerability Description
FasterXML jackson-databind是FasterXML公司的一个基于JAVA可以将XML和JSON等数据格式与JAVA对象进行转换的库。Jackson可以轻松的将Java对象转换成json对象和xml文档，同样也可以将json、xml转换成Java对象。 FasterXML Jackson-databind 2.8.10之前版本和2.9.1之前版本中存在代码问题漏洞。攻击者可通过向ObjectMapper的readValue方法发送特制的输入利用该漏洞执行代码。
CVSS Information
N/A
Vulnerability Type
N/A