ZeroDay Findings
Sign inSign up

Findings

CVE-2018-14721

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2…

Published Jan 2, 2019 · updated Oct 15, 2026 · fasterxml jackson-databind

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Jan 2, 2019 · NIST NVD

    Detected

    FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.

  2. Oct 15, 2026 · NIST NVD

    Updated

    FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.

Affected

  • cpe debian/debian linux8.0
  • cpe fasterxml/jackson-databindversion unspecified
  • cpe fasterxml/jackson-databind2.7.0
  • cpe fasterxml/jackson-databind2.8.0
  • cpe oracle/banking platform2.5.0
  • cpe redhat/jboss enterprise application platform7.2.0

Sources

  • CVE.orgVulnerability recordCVE-2018-14721

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2018-14721

    FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.

    nvd.nist.gov

References

CVE-2018-14721 · ZeroDay Findings