CVE-2018-11307

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-07-09 · updated 2026-10-08
Weakness: CWE-502

Description

An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6.

Affected products

FasterXML jackson-databind: from 2.0.0 before 2.6.7.3; from 2.7.0 before 2.7.9.4; from 2.8.0 before 2.8.11.2; from 2.9.0 before 2.9.6 — fixed in 2.6.7.3, 2.7.9.4, 2.8.11.2, 2.9.6
Oracle Clusterware: 12.1.0.2.0
Oracle Communications Instant Messaging Server: 10.0.1.2.0
Oracle Global Lifecycle Management Opatch: before 11.2.0.3.23; from 12.2.0.1.0 before 12.2.0.1.19; from 13.9.4.0.0 before 13.9.4.2.1 — fixed in 11.2.0.3.23, 12.2.0.1.19, 13.9.4.2.1
Oracle Corporation Retail Customer Management and Segmentation Foundation: 17.0
Oracle Utilities Advanced Spatial And Operational Analytics: 2.7.0.1
Red Hat OpenShift Container Platform 4.18: 3.11, 4.1

How to fix

Upgrade to a fixed version: FasterXML jackson-databind 2.6.7.3, 2.7.9.4, 2.8.11.2, 2.9.6; Oracle Global Lifecycle Management Opatch 11.2.0.3.23, 12.2.0.1.19, 13.9.4.2.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2018-11307 or the next vulnerability affects your stack