PT-2019-5307 · Codehaus+3 · Jackson-Mapper-Asl+3

Mark Denihan · Published 2019-11-18 · Updated 2025-04-23 · CVE-2019-10172

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions org.codehaus.jackson:jackson-mapper-asl versions 1.9.x

Description A flaw was found in the org.codehaus.jackson:jackson-mapper-asl library, related to incorrect restriction of XML external entity references. This issue is similar to previously identified vulnerabilities and can be exploited by a remote attacker to impact data integrity.

Recommendations For org.codehaus.jackson:jackson-mapper-asl version 1.9.x, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2020-02254

CVE-2019-10172

DLA-2091-1

DLA-2342-1

GHSA-R6J9-8759-G62W

OESA-2021-1342

RHSA-2020:2058

RHSA-2020:2059

RHSA-2020:2060

RHSA-2020:2511

RHSA-2020:2512

RHSA-2020:2513

USN-4741-1

Affected Products

Astra Linux

Confluence

Ubuntu

Jackson-Mapper-Asl

References · 108

• 🔥 https://github.com/SecureSkyTechnology/study-struts2-s2-054_055-jackson-cve-2017-7525_cve-2017-15095 · Exploit
• 🔥 https://github.com/JavanXD/Demo-Exploit-Jackson-RCE · Exploit
• 🔥 https://github.com/Ingenuity-Fainting-Goats/CVE-2017-7525-Jackson-Deserialization-Lab · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10172 · Security Note
• https://bdu.fstec.ru/vul/2020-02254 · Security Note
• https://osv.dev/vulnerability/CVE-2019-10172 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2021-1342 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4741-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-10172 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2019-10172 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10172 · Security Note
• https://osv.dev/vulnerability/DLA-2091-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-10172 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4741-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r6j9-8759-g62w · Vendor Advisory