XML External Entity (XXE) Vulnerability in FasterXML jackson-databind 2.x before 2.9.7

CVE-2018-14720 · HIGH Severity

AV:N/AC:L/AU:N/C:P/I:P/A:P

FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.

Learn more about our Cis Benchmark Audit For Bind.