EXPOSURES › CVE-2018-11307
CVE-2018-11307
CRITICAL
DETAIL
SourceNVD · cve
Published2019-07-09
CVSS9.8
Referencehttps://nvd.nist.gov/vuln/detail/CVE-2018-11307 ↗
▸ RECOMMENDED ACTION Critical severity — schedule patching of the affected products.
PLAYERS IMPLICATED
Oracle · vendorfasterxml · vendorredhat · vendorclusterware · productcommunications instant messaging server · productenterprise linux · productglobal lifecycle management opatch · productjackson-databind · productopenshift container platform · productretail customer management and segmentation foundation · productutilities advanced spatial and operational analytics · product
DESCRIPTION
An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6.
SENTIMENT · TRUSTED SOURCES
synthesis
neutral
+0.00
No coverage or sentiment data available from provided sources.
No coverage or sentiment data available from provided sources.
No coverage or sentiment data available from provided sources.
AFFECTED FEDRAMP PRODUCTS · 10
| PRODUCT | STATUS |
|---|---|
| Aconex for Defense Oracle |
Authorized |
| Federal Managed Cloud Services Oracle |
Authorized |
| Fusion Cloud Oracle |
Authorized |
| Government Cloud - Common Controls Oracle |
Authorized |
| Oracle Cloud Infrastructure-Government Cloud Oracle |
Authorized |
| Oracle Enterprise Performance Management (EPM) Oracle |
Authorized |
| Oracle Enterprise Performance Management (EPM) - Moderate Oracle |
In Process |
| Oracle Service Cloud Oracle |
Authorized |
| Oracle Service Cloud (DOD) Oracle |
Authorized |
| Taleo Cloud - U.S. Government Cloud Oracle |
Authorized |