$ cve CVE-2018-14719 JSON

CVE-2018-14719

9.8

CRITICAL · CVSS 3.1 · EPSS 9.7% (pctl 95)

In your normal cycle

Critical by CVSS (9.8), but no sign of active exploitation.

Description

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.

Scoring

CVSS	9.8 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	9.68% — more likely to be exploited than 95% of all CVEs
Weakness	CWE-502
On CISA KEV	no
Public exploit	none known
Published	2019-01-02
Last modified	2026-06-17

Affected (21)

Vendor	Product
debian	debian linux
fasterxml	jackson-databind
netapp	oncommand workflow automation
netapp	snapcenter
netapp	steelstore cloud integrated storage
oracle	banking platform
oracle	business process management suite
oracle	clusterware
oracle	communications billing and revenue management
oracle	database server
oracle	enterprise manager for virtualization
oracle	financial services analytical applications infrastructure
oracle	global lifecycle management opatch
oracle	jdeveloper
oracle	primavera p6 enterprise project portfolio management
oracle	primavera unifier
oracle	retail merchandising system
oracle	retail workforce management software
oracle	webcenter portal
redhat	enterprise linux
redhat	openshift container platform

References

→ the Explorer · watch your stack · NVD