EXPOSURES › CVE-2019-16942
CVE-2019-16942
CRITICAL
DETAIL
SourceNVD · cve
Published2019-10-01
CVSS9.8
Referencehttps://nvd.nist.gov/vuln/detail/CVE-2019-16942 ↗
▸ RECOMMENDED ACTION Critical severity — schedule patching of the affected products.
PLAYERS IMPLICATED
NetApp · vendorOracle · vendordebian · vendorfasterxml · vendorfedoraproject · vendorredhat · vendorWebLogic Server · productactive iq unified manager · productbanking platform · productcommunications billing and revenue management · productcommunications calendar server · productcommunications cloud native core network slice selection function · productcommunications evolved communications application server · productdatabase server · productdebian linux · productenterprise linux · productfedora · productglobal lifecycle management nextgen oui framework · productgoldengate application adapters · productjackson-databind · productjboss enterprise application platform · productjd edwards enterpriseone orchestrator · productjd edwards enterpriseone tools · productoncommand api services · productoncommand workflow automation · productprimavera gateway · productprimavera unifier · productretail merchandising system · productretail sales audit · productservice level manager · productsiebel engineering - installer \& deployment · productsiebel ui framework · productsteelstore cloud integrated storage · productwebcenter portal · productwebcenter sites · product
DESCRIPTION
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling.
SENTIMENT · TRUSTED SOURCES
synthesis
neutral
+0.00
No coverage found for vendor sentiment.
No coverage found for vendor sentiment.
AFFECTED FEDRAMP PRODUCTS · 11
| PRODUCT | STATUS |
|---|---|
| Aconex for Defense Oracle |
Authorized |
| Cloud Insights NetApp |
In Process |
| Federal Managed Cloud Services Oracle |
Authorized |
| Fusion Cloud Oracle |
Authorized |
| Government Cloud - Common Controls Oracle |
Authorized |
| Oracle Cloud Infrastructure-Government Cloud Oracle |
Authorized |
| Oracle Enterprise Performance Management (EPM) Oracle |
Authorized |
| Oracle Enterprise Performance Management (EPM) - Moderate Oracle |
In Process |
| Oracle Service Cloud Oracle |
Authorized |
| Oracle Service Cloud (DOD) Oracle |
Authorized |
| Taleo Cloud - U.S. Government Cloud Oracle |
Authorized |