CVE-2018-11307 @ Maven-com.fasterxml.jackson.core:jackson-databind-2.0.4

[cxronen]

Vulnerable Package issue exists @ Maven-com.fasterxml.jackson.core:jackson-databind-2.0.4 in branch master

A vulnerability was found in FasterXML jackson-databind before versions 2.6.7.3, 2.7.9.4, 2.8.11.2, 2.9.6. A new potential gadget type from MyBatis has been reported, and may allow content exfiltration (remote access by sending contents over ftp) when untrusted content is deserialized with default typing enabled.

Namespace: cxronen
Repository: BookStore_VSCode
Repository Url: https://github.com/cxronen/BookStore_VSCode
CxAST-Project: cxronen/BookStore_VSCode
CxAST platform scan: bd7a4263-ea5f-49fd-8fdb-752c76ed1f15
Branch: master
Application: BookStore_VSCode
Severity: HIGH
State: NOT_IGNORED
Status: NEW
CWE: CWE-502

---

Additional Info
Attack vector: NETWORK
Attack complexity: LOW
Confidentiality impact: HIGH
Availability impact: HIGH
Remediation Upgrade Recommendation: 2.6.7.5

---

References
Issue
Commit
Advisory
Release Note
Release Note
Release Note