{"cve":"CVE-2017-15095","nvd":{"published":"2018-02-06T15:29:00.233","modified":"2026-10-08T22:16:40.377","status":"Modified","description":"A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-502","CWE-184"],"references":["http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103880","http://www.securitytracker.com/id/1039769"],"products":["debian:debian_linux","fasterxml:jackson-databind","netapp:oncommand_balance","netapp:oncommand_performance_manager","netapp:oncommand_shift","netapp:snapcenter","oracle:banking_platform","oracle:clusterware","oracle:communications_billing_and_revenue_management","oracle:communications_diameter_signaling_router","oracle:communications_instant_messaging_server","oracle:database_server","oracle:enterprise_manager_for_virtualization","oracle:financial_services_analytical_applications_infrastructure","oracle:global_lifecycle_management_opatchauto","oracle:identity_manager","oracle:jd_edwards_enterpriseone_tools","oracle:primavera_unifier","oracle:utilities_advanced_spatial_and_operational_analytics","oracle:webcenter_portal","redhat:jboss_enterprise_application_platform","redhat:openshift_container_platform","redhat:satellite","redhat:satellite_capsule"],"source":"nvd","synced_at":"2026-10-19T20:48:34.567387330+00:00"},"epss":{"cve":"CVE-2017-15095","score":0.08357,"percentile":0.94923,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-h592-38cm-4ggp","url":"https://osv.dev/vulnerability/GHSA-h592-38cm-4ggp","summary":"jackson-databind vulnerable to deserialization flaw leading to unauthenticated remote code execution","modified":"2024-03-15T01:16:50.905794Z","packages":[{"ecosystem":"Maven","name":"com.fasterxml.jackson.core:jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind","ranges":[">=2.8.0 <2.8.11"],"fixed":["2.8.11"]},{"ecosystem":"Maven","name":"com.fasterxml.jackson.core:jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind","ranges":[">=2.9.0 <2.9.4"],"fixed":["2.9.4"]},{"ecosystem":"Maven","name":"com.fasterxml.jackson.core:jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind","ranges":[">=2.0.0 <2.6.7.3"],"fixed":["2.6.7.3"]},{"ecosystem":"Maven","name":"com.fasterxml.jackson.core:jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind","ranges":[">=2.7.0 <2.7.9.2"],"fixed":["2.7.9.2"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}