CVE-2017-7525

CriticalCVSS 9.8/10Last modified Oct 8, 2026

Description

A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-184 CWE-502

Affected software

No affected versions have been published.

Timeline

Published: Feb 6, 2018
Last modified: Oct 8, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-75266.8libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024 while using the left CVE-2017-75286.5Ansible Tower as shipped with Red Hat CloudForms Management Engine 5 is vulnerable to CRLF Injection. It was found that X-Forwarded-For head CVE-2017-75297.5Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resultin CVE-2017-75308.8In CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1, it was found that privilege check is missing when invoking arbit CVE-2017-75314.3In Moodle 3.3, the course overview block reveals activities in hidden courses.CVE-2017-75326.5In Moodle 3.x, course creators are able to change system default settings for courses.CVE-2017-75337.0Race condition in the fsnotify implementation in the Linux kernel through 4.12.4 allows local users to gain privileges or cause a denial of CVE-2017-75345.4OpenShift Enterprise version 3.x is vulnerable to a stored XSS via the log viewer for pods. The flaw is due to lack of sanitation of user in CVE-2017-75356.1foreman before version 1.16.0 is vulnerable to a stored XSS in organizations/locations assignment to hosts. Exploiting this requires a user CVE-2017-75367.0In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, whi CVE-2017-75377.5It was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the pki-core package befor CVE-2017-75385.4A cross-site scripting (XSS) flaw was found in how an organization name is displayed in Satellite 5, before 5.8. A user able to change an or