Jboss EAP Deserialization of Untrusted Data Vulnerability - CVE-2019-14892 - Vulnerability Database

Jboss EAP Deserialization of Untrusted Data Vulnerability - CVE-2019-14892

Critical

Reference: CVE-2019-14892

NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2019-14892

Title: Jboss EAP Deserialization of Untrusted Data Vulnerability

Overview:

A flaw was discovered in jackson-databind in versions before 2.9.10 2.8.11.5 and 2.6.7.3 where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.