// For flags

CVE-2019-12086

jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server.

Severity Score

7.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

3
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpath, and an attacker can host a crafted MySQL server reachable by the victim, an attacker can send a crafted JSON message that allows them to read arbitrary local files on the server. This occurs because of missing com.mysql.cj.jdbc.admin.MiniAdmin validation.

Se descubrió un problema de tipificación polimórfica en FasterXML jackson-databind 2.x antes del 2.9.9. Cuando la escritura predeterminada está habilitada (ya sea globalmente o para una propiedad específica) para un dispositivo remoto JSON expuesto externamente, el servicio tiene el myjq-connector-java jar (8.0.14 o anterior) en el classpath, y un atacante puede alojar un servidor MySQL creado accesible por la víctima, pudiendo enviar un mensaje JSON diseñado que les permite leer archivos locales arbitrarios en el servidor. Esto ocurre debido a la falta de validación com.mysql.cj.jdbc.admin.MiniAdmin.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2019-05-13 CVE Reserved
  • 2019-05-17 CVE Published
  • 2019-05-27 First Exploit
  • 2024-05-10 EPSS Updated
  • 2024-08-04 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-502: Deserialization of Untrusted Data
CAPEC
References (45)
URL Tag Source
http://www.securityfocus.com/bid/109227 Third Party Advisory
https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.9 Release Notes
https://lists.apache.org/thread.html/3f99ae8dcdbd69438cb733d745ee3ad5e852068490719a66509b4592%40%3Ccommits.cassandra.apache.org%3E Mailing List
https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E Mailing List
https://lists.apache.org/thread.html/88cd25375805950ae7337e669b0cb0eeda98b9604c1b8d806dccbad2%40%3Creviews.spark.apache.org%3E Mailing List
https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E Mailing List
https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E Mailing List
https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rda99599896c3667f2cc9e9d34c7b6ef5d2bbed1f4801e1d75a2b0679%40%3Ccommits.nifi.apache.org%3E Mailing List
https://lists.debian.org/debian-lts-announce/2019/05/msg00030.html Mailing List
https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 X_refsource_misc
https://seclists.org/bugtraq/2019/May/68 Mailing List
https://security.netapp.com/advisory/ntap-20190530-0003 Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.html Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2020.html Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2020.html Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.html Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html Third Party Advisory
URL Date SRC
https://github.com/motoyasu-saburi/CVE-2019-12086-jackson-databind-file-read 2019-05-27
https://github.com/Al1ex/CVE-2019-12086 2020-05-22
http://russiansecurity.expert/2016/04/20/mysql-connect-file-read 2024-08-04
URL Date SRC
https://github.com/FasterXML/jackson-databind/issues/2326 2023-11-07
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html 2023-11-07
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html 2023-11-07
URL Date SRC
https://access.redhat.com/errata/RHSA-2019:2858 2023-11-07
https://access.redhat.com/errata/RHSA-2019:2935 2023-11-07
https://access.redhat.com/errata/RHSA-2019:2936 2023-11-07
https://access.redhat.com/errata/RHSA-2019:2937 2023-11-07
https://access.redhat.com/errata/RHSA-2019:2938 2023-11-07
https://access.redhat.com/errata/RHSA-2019:2998 2023-11-07
https://access.redhat.com/errata/RHSA-2019:3044 2023-11-07
https://access.redhat.com/errata/RHSA-2019:3045 2023-11-07
https://access.redhat.com/errata/RHSA-2019:3046 2023-11-07
https://access.redhat.com/errata/RHSA-2019:3050 2023-11-07
https://access.redhat.com/errata/RHSA-2019:3149 2023-11-07
https://access.redhat.com/errata/RHSA-2019:3200 2023-11-07
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OVRZDN2T6AZ6DJCZJ3VSIQIVHBVMVWBL 2023-11-07
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TXRVXNRFHJSQWFHPRJQRI5UPMZ63B544 2023-11-07
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKUALE2TUCKEKOHE2D342PQXN4MWCSLC 2023-11-07
https://www.debian.org/security/2019/dsa-4452 2023-11-07
https://access.redhat.com/security/cve/CVE-2019-12086 2020-07-28
https://bugzilla.redhat.com/show_bug.cgi?id=1713468 2020-07-28
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Fasterxml
Search vendor "Fasterxml"
 Jackson-databind
Search vendor "Fasterxml" for product "Jackson-databind"
 >= 2.0.0 < 2.6.7.3
Search vendor "Fasterxml" for product "Jackson-databind" and version " >= 2.0.0 < 2.6.7.3"
-
Affected
Fasterxml
Search vendor "Fasterxml"
 Jackson-databind
Search vendor "Fasterxml" for product "Jackson-databind"
 >= 2.7.0 < 2.7.9.6
Search vendor "Fasterxml" for product "Jackson-databind" and version " >= 2.7.0 < 2.7.9.6"
-
Affected
Fasterxml
Search vendor "Fasterxml"
 Jackson-databind
Search vendor "Fasterxml" for product "Jackson-databind"
 >= 2.8.0 < 2.8.11.4
Search vendor "Fasterxml" for product "Jackson-databind" and version " >= 2.8.0 < 2.8.11.4"
-
Affected
Fasterxml
Search vendor "Fasterxml"
 Jackson-databind
Search vendor "Fasterxml" for product "Jackson-databind"
 >= 2.9.0 < 2.9.9
Search vendor "Fasterxml" for product "Jackson-databind" and version " >= 2.9.0 < 2.9.9"
-
Affected
Debian
Search vendor "Debian"
 Debian Linux
Search vendor "Debian" for product "Debian Linux"
 8.0
Search vendor "Debian" for product "Debian Linux" and version "8.0"
-
Affected
Debian
Search vendor "Debian"
 Debian Linux
Search vendor "Debian" for product "Debian Linux"
 9.0
Search vendor "Debian" for product "Debian Linux" and version "9.0"
-
Affected