CVE-2018-12022 @ Maven-com.fasterxml.jackson.core:jackson-databind-2.0.4

[cxronen]

Vulnerable Package issue exists @ Maven-com.fasterxml.jackson.core:jackson-databind-2.0.4 in branch master

An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Jodd-db jar (for database access for the Jodd framework) in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.

Namespace: cxronen
Repository: BookStore_VSCode
Repository Url: https://github.com/cxronen/BookStore_VSCode
CxAST-Project: cxronen/BookStore_VSCode
CxAST platform scan: bd7a4263-ea5f-49fd-8fdb-752c76ed1f15
Branch: master
Application: BookStore_VSCode
Severity: HIGH
State: NOT_IGNORED
Status: NEW
CWE: CWE-502

---

Additional Info
Attack vector: NETWORK
Attack complexity: HIGH
Confidentiality impact: HIGH
Availability impact: HIGH
Remediation Upgrade Recommendation: 2.6.7.5

---

References
Advisory
Issue
Commit
Advisory