$ cve CVE-2017-17485 JSON

CVE-2017-17485

9.8

CRITICAL · CVSS 3.1 · EPSS 49.7% (pctl 99)

Patch early

EPSS 49.7% — above the 10% action threshold.

Description

FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the Spring libraries are available in the classpath.

Scoring

CVSS	9.8 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	49.73% — more likely to be exploited than 99% of all CVEs
Weakness	CWE-502
On CISA KEV	no
Public exploit	none known
Published	2018-01-10
Last modified	2026-06-17

Affected (9)

Vendor	Product
debian	debian linux
fasterxml	jackson-databind
netapp	e-series santricity os controller
netapp	e-series santricity web services proxy
netapp	oncommand shift
netapp	snapcenter
redhat	enterprise linux server
redhat	jboss enterprise application platform
redhat	openshift container platform

References

→ the Explorer · watch your stack · NVD