EXPOSURES › CVE-2018-14720
CVE-2018-14720
CRITICAL
DETAIL
SourceNVD · cve
Published2019-01-02
CVSS9.8
Referencehttps://nvd.nist.gov/vuln/detail/CVE-2018-14720 ↗
▸ RECOMMENDED ACTION Critical severity — schedule patching of the affected products.
PLAYERS IMPLICATED
Oracle · vendordebian · vendorfasterxml · vendorredhat · vendorbanking platform · productcommunications billing and revenue management · productdebian linux · productenterprise manager for virtualization · productfinancial services analytical applications infrastructure · productjackson-databind · productjboss enterprise application platform · productjdeveloper · productopenshift container platform · productprimavera unifier · productretail merchandising system · productwebcenter portal · product
DESCRIPTION
FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.
SENTIMENT · TRUSTED SOURCES
synthesis
neutral
+0.00
No coverage or sentiment data available for Debian regarding CVE-2018-14720 in the provided sources.
Neutral; source only provides NVD technical description without sentiment or vendor-specific commentary.
"FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization."
Neutral; source returned a connection error and contains no relevant content.
AFFECTED FEDRAMP PRODUCTS · 10
| PRODUCT | STATUS |
|---|---|
| Aconex for Defense Oracle |
Authorized |
| Federal Managed Cloud Services Oracle |
Authorized |
| Fusion Cloud Oracle |
Authorized |
| Government Cloud - Common Controls Oracle |
Authorized |
| Oracle Cloud Infrastructure-Government Cloud Oracle |
Authorized |
| Oracle Enterprise Performance Management (EPM) Oracle |
Authorized |
| Oracle Enterprise Performance Management (EPM) - Moderate Oracle |
In Process |
| Oracle Service Cloud Oracle |
Authorized |
| Oracle Service Cloud (DOD) Oracle |
Authorized |
| Taleo Cloud - U.S. Government Cloud Oracle |
Authorized |