mirror of
https://github.com/0xMarcio/cve.git
synced 2026-05-22 01:36:58 +02:00
0xMarcio
1.5 KiB
1.5 KiB
CVE-2018-11307
Description
An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6.
POC
Reference
- https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
- https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
Github
- https://github.com/A-TPL-Bench/LibHunter
- https://github.com/ARPSyndicate/cvemon
- https://github.com/Anonymous-Phunter/PHunter
- https://github.com/CGCL-codes/LibHunter
- https://github.com/CGCL-codes/PHunter
- https://github.com/LibHunter/LibHunter
- https://github.com/OWASP/www-project-ide-vulscanner
- https://github.com/ilmari666/cybsec
- https://github.com/seal-community/patches
- https://github.com/yahoo/cubed