CVE-2017-7525

CriticalCVSS 9.8/10Last modified Oct 8, 2026

Description

A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-184CWE-502

Affected software

VendorProductVersions
FasterXMLjackson-databindbefore 2.6.7.1; before 2.7.9.1; before 2.8.9

References

Timeline

Published
Feb 6, 2018
Last modified
Oct 8, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-75266.8libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024 while using the leftCVE-2017-75286.5Ansible Tower as shipped with Red Hat CloudForms Management Engine 5 is vulnerable to CRLF Injection. It was found that X-Forwarded-For headCVE-2017-75297.5Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resultinCVE-2017-75308.8In CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1, it was found that privilege check is missing when invoking arbitCVE-2017-75314.3In Moodle 3.3, the course overview block reveals activities in hidden courses.CVE-2017-75326.5In Moodle 3.x, course creators are able to change system default settings for courses.CVE-2017-75337.0Race condition in the fsnotify implementation in the Linux kernel through 4.12.4 allows local users to gain privileges or cause a denial of CVE-2017-75345.4OpenShift Enterprise version 3.x is vulnerable to a stored XSS via the log viewer for pods. The flaw is due to lack of sanitation of user inCVE-2017-75356.1foreman before version 1.16.0 is vulnerable to a stored XSS in organizations/locations assignment to hosts. Exploiting this requires a user CVE-2017-75367.0In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, whiCVE-2017-75377.5It was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the pki-core package beforCVE-2017-75385.4A cross-site scripting (XSS) flaw was found in how an organization name is displayed in Satellite 5, before 5.8. A user able to change an or
CVE-2017-7525: Critical severity, CVSS 9.8 | Vulnix