$ cve CVE-2018-7489 JSON

CVE-2018-7489

9.8

CRITICAL · CVSS 3.0 · EPSS 19.8% (pctl 97)

Patch early

EPSS 19.8% — above the 10% action threshold.

Description

FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.

Scoring

CVSS	9.8 (CRITICAL, v3.0)
Vector	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	19.78% — more likely to be exploited than 97% of all CVEs
Weakness	CWE-184
On CISA KEV	no
Public exploit	none known
Published	2018-02-26
Last modified	2026-06-17

Affected (5)

Vendor	Product
debian	debian linux
fasterxml	jackson-databind
oracle	communications billing and revenue management
oracle	communications instant messaging server
redhat	jboss enterprise application platform

References

→ the Explorer · watch your stack · NVD