VULNERABILITY INTELLIGENCE

CVE-2019-14892

CVSS score9.8 CRITICAL
EPSS probability5.58%
CISA KEVNot currently listed
Published2020-03-02
Last modified2026-10-08
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.

Weakness classification

  • secalert@redhat.com: CWE-200
  • nvd@nist.gov: CWE-502

Primary references