Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Jboss EAP Deserialization of Untrusted Data Vulnerability - CVE-2017-17485 - Vulnerability Database
Jboss EAP

Jboss EAP Deserialization of Untrusted Data Vulnerability - CVE-2017-17485

Critical
Reference: CVE-2017-17485
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2017-17485
Title: Jboss EAP Deserialization of Untrusted Data Vulnerability
Overview:

FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper bypassing a blacklist that is ineffective if the Spring libraries are available in the classpath.