CVE-2019-16943 @ Maven-com.fasterxml.jackson.core:jackson-databind-2.0.4

[cxronen]

Vulnerable Package issue exists @ Maven-com.fasterxml.jackson.core:jackson-databind-2.0.4 in branch master

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.7.9.7, 2.8.x before 2.8.11.5 and 2.9.x up to 2.9.10.1. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling.

Namespace: cxronen
Repository: BookStore_VSCode
Repository Url: https://github.com/cxronen/BookStore_VSCode
CxAST-Project: cxronen/BookStore_VSCode
CxAST platform scan: bd7a4263-ea5f-49fd-8fdb-752c76ed1f15
Branch: master
Application: BookStore_VSCode
Severity: HIGH
State: NOT_IGNORED
Status: NEW
CWE: CWE-20

---

Additional Info
Attack vector: NETWORK
Attack complexity: LOW
Confidentiality impact: HIGH
Availability impact: HIGH
Remediation Upgrade Recommendation: 2.6.7.5

---

References
Issue
Commit
Advisory