CVE-2018-14720
criticalFasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK c…
Vendor / product: Fasterxml — jackson-databind
FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.
CVSS
9.8
9.8 (CVSS v3.0)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity source: NVD CVSS v3.0 (nvd@nist.gov)
Timeline (UTC)
Published: 2019-01-02 18:29
Modified: 2026-10-15 18:17
NVD status: Modified
Last synced 2 days ago
Verified against the source API 2026-10-27 07:06 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
fasterxml / jackson-databind ≥2.6.0 <2.6.7.2, ≥2.7.0 <2.7.9.5, ≥2.8.0 <2.8.11.3, ≥2.9.0 <2.9.7, 2.7.0, 2.8.0
debian / debian_linux 8.0, 9.0
oracle / banking_platform 2.5.0, 2.6.0, 2.6.1, 2.6.2
oracle / communications_billing_and_revenue_management 7.5, 12.0
oracle / enterprise_manager_for_virtualization 13.2.2, 13.2.3, 13.3.1
oracle / financial_services_analytical_applications_infrastructure 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7
oracle / jdeveloper 12.1.3.0.0, 12.2.1.3.0
oracle / primavera_unifier ≥17.1 ≤17.12, 16.1, 16.2, 18.8
oracle / retail_merchandising_system 15.0, 16.0
oracle / webcenter_portal 12.2.1.3.0
redhat / jboss_enterprise_application_platform 7.2.0
redhat / openshift_container_platform 3.11
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Patch / mitigation: https://github.com/FasterXML/jackson-databind/commit/87d29af25e82a249ea15858e2d4ecbf64091db44
Patch / mitigation: https://github.com/FasterXML/jackson-databind/issues/2097
Patch / mitigation: https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.7
Patch / mitigation: https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
Patch / mitigation: https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
Patch / mitigation: https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
Patch / mitigation: https://github.com/FasterXML/jackson-databind/commit/87d29af25e82a249ea15858e2d4ecbf64091db44
Patch / mitigation: https://github.com/FasterXML/jackson-databind/issues/2097
Patch / mitigation: https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.7
Patch / mitigation: https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
References
- https://access.redhat.com/errata/RHBA-2019:0959 cve@mitre.org
- https://access.redhat.com/errata/RHSA-2019:0782 cve@mitre.org
- https://access.redhat.com/errata/RHSA-2019:1106 cve@mitre.org
- https://access.redhat.com/errata/RHSA-2019:1107 cve@mitre.org
- https://access.redhat.com/errata/RHSA-2019:1108 cve@mitre.org
- https://access.redhat.com/errata/RHSA-2019:1140 cve@mitre.org
- https://access.redhat.com/errata/RHSA-2019:1822 cve@mitre.org
- https://access.redhat.com/errata/RHSA-2019:1823 cve@mitre.org
- https://access.redhat.com/errata/RHSA-2019:2858 cve@mitre.org
- https://access.redhat.com/errata/RHSA-2019:3149 cve@mitre.org
- https://access.redhat.com/errata/RHSA-2019:3892 cve@mitre.org
- https://access.redhat.com/errata/RHSA-2019:4037 cve@mitre.org
- https://github.com/FasterXML/jackson-databind/commit/87d29af25e82a249ea15858e2d4ecbf64091d... cve@mitre.org
- https://github.com/FasterXML/jackson-databind/issues/2097 cve@mitre.org
- https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.7 cve@mitre.org
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b51... cve@mitre.org
- https://lists.apache.org/thread.html/6a78f88716c3c57aa74ec05764a37ab3874769a347805903b393b... cve@mitre.org
- https://lists.apache.org/thread.html/82b01bfb6787097427ce97cec6a7127e93718bc05d1efd5eaffc2... cve@mitre.org
- https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1... cve@mitre.org
- https://lists.apache.org/thread.html/ba973114605d936be276ee6ce09dfbdbf78aa56f6cdc6e79bfa7b... cve@mitre.org
- https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e1... cve@mitre.org
- https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a... cve@mitre.org
- https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd5... cve@mitre.org
- https://lists.debian.org/debian-lts-announce/2019/03/msg00005.html cve@mitre.org
- https://seclists.org/bugtraq/2019/May/68 cve@mitre.org
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 07:06 UTC · record ↗