CVE-2019-17531

Published: Oct 12, 2019Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload.

Affected (48)

Products: Fasterxml: Jackson Databind · Debian: Debian Linux · Redhat: Jboss Enterprise Application Platform · +2 more

Show all products

1 product

1 product

1 product

Jboss Enterprise Application Platform

Oracle

17 products

Banking Platform

Communications Billing And Revenue Management

Communications Calendar Server

Communications Cloud Native Core Network Slice Selection Function

Communications Evolved Communications Application Server

Global Lifecycle Management Nextgen Oui Framework

Goldengate Application Adapters

Jd Edwards Enterpriseone Orchestrator

Jd Edwards Enterpriseone Tools

Primavera Gateway

Retail Merchandising System

Retail Sales Audit

Siebel Engineering Installer & Deployment

2 products

Oncommand Workflow Automation

Steelstore Cloud Integrated Storage

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Fasterxml Jackson Databind	From 2.0.0 to 2.6.7.3
Fasterxml Jackson Databind	From 2.7.0 to 2.8.11.5
Fasterxml Jackson Databind	From 2.9.0 to 2.9.10.1

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0

Configuration C

2 vulnerable · 3 platform

Vulnerable Software	Affected Versions
Redhat Jboss Enterprise Application Platform	Version 7.2
Redhat Jboss Enterprise Application Platform	Version 7.3

Running on/with	Platform Versions
Redhat Enterprise Linux Server	Version 6.0
Redhat Enterprise Linux Server	Version 7.0
Redhat Enterprise Linux Server	Version 8.0

Configuration D

40 vulnerable

Vulnerable Software	Affected Versions
Oracle Banking Platform	Version 2.4.0
Oracle Banking Platform	Version 2.4.1
Oracle Banking Platform	Version 2.5.0
Oracle Banking Platform	Version 2.6.0
Oracle Banking Platform	Version 2.6.1
Oracle Banking Platform	Version 2.6.2
Oracle Banking Platform	Version 2.7.0
Oracle Banking Platform	Version 2.7.1
Oracle Banking Platform	Version 2.9.0
Oracle Communications Billing And Revenue Management	Version 12.0.0.3.0
Oracle Communications Billing And Revenue Management	Version 7.5.0.23.0
Oracle Communications Calendar Server	Version 8.0.0.2.0
Oracle Communications Calendar Server	Version 8.0.0.3.0
Oracle Communications Cloud Native Core Network Slice Selection Function	Version 1.2.1
Oracle Communications Evolved Communications Application Server	Version 7.1
Oracle Global Lifecycle Management Nextgen Oui Framework	Version 12.2.1.3.0
Oracle Global Lifecycle Management Nextgen Oui Framework	Version 12.2.1.4.0
Oracle Global Lifecycle Management Nextgen Oui Framework	Version 13.9.4.2.2
Oracle Goldengate Application Adapters	Version 19.1.0.0.0
Oracle Jd Edwards Enterpriseone Orchestrator	Version 9.2
Oracle Jd Edwards Enterpriseone Tools	Version 9.2
Oracle Primavera Gateway	From 17.7 to 17.12.6
Oracle Primavera Gateway	From 18.8.0 to 18.8.8
Oracle Primavera Gateway	Version 16.1
Oracle Primavera Gateway	Version 16.2
Oracle Primavera Gateway	Version 19.12.0
Oracle Retail Merchandising System	Version 15.0.3
Oracle Retail Merchandising System	Version 16.0.2
Oracle Retail Merchandising System	Version 16.0.3
Oracle Retail Sales Audit	Version 14.1
Oracle Siebel Engineering Installer & Deployment	Up to 2.20.5
Oracle Trace File Analyzer	Version 12.2.0.1
Oracle Trace File Analyzer	Version 18c
Oracle Trace File Analyzer	Version 19c
Oracle Webcenter Portal	Version 12.2.1.3.0
Oracle Webcenter Portal	Version 12.2.1.4.0
Oracle Webcenter Sites	Version 12.2.1.3.0
Oracle Webcenter Sites	Version 12.2.1.4.0
Oracle Weblogic Server	Version 12.2.1.3.0
Oracle Weblogic Server	Version 12.2.1.4.0