VDB

CVE-2019-12384

CVE-2019-12384 PUBLISHED

FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execution may be possible.

EPSS 51.27% · 97.9th percentile

Risk Scores

EPSS Score
51.27%
97.9th percentile

Affected Products

VendorProductVersions
Ubuntu:Pro:14.04:LTSjackson-databind0, 2.2.2-1ubuntu0.1~esm1, 2.2.2-1
Ubuntu:18.04:LTSjackson-databind0, 2.9.4-1, 2.9.5-1
Ubuntu:Pro:16.04:LTSjackson-databind2.4.2-2, 2.4.2-3ubuntu0.1~esm1, 2.4.2-3

Exploit Intelligence

…and 330 more exploits

Timeline

  • Jun 24, 2019 CVE Published
  • Apr 14, 2021 EPSS Score
  • Jun 28, 2021 PoC Published
  • Dec 11, 2021 PoC Published
  • Dec 13, 2021 PoC Published
  • Dec 18, 2021 PoC Published
  • Apr 7, 2022 PoC Published
  • Jun 7, 2022 PoC Published
  • Sep 16, 2022 PoC Published
  • Mar 7, 2023 EPSS Score
  • Sep 14, 2023 EPSS Score
  • Oct 21, 2023 PoC Published

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›