CVE-2018-14720

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 7.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-01-02 · updated 2026-10-15
Weakness: CWE-502

Description

FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.

Affected products

Debian Linux: 8.0, 9.0
FasterXML jackson-databind: from 2.6.0 before 2.6.7.2; from 2.7.0 before 2.7.9.5; from 2.8.0 before 2.8.11.3; from 2.9.0 before 2.9.7; 2.7.0-rc1, 2.7.0-rc2, 2.7.0-rc3, 2.8.0-rc1, 2.8.0-rc2, 2.9.0-pr1 (+3) — fixed in 2.6.7.2, 2.7.9.5, 2.8.11.3, 2.9.7
Oracle Banking Platform: 2.5.0, 2.6.0, 2.6.1, 2.6.2
Oracle Corporation Communications Billing and Revenue Management: 7.5, 12.0
Oracle Enterprise Manager For Virtualization: 13.2.2, 13.2.3, 13.3.1
Oracle Corporation Financial Services Analytical Applications Infrastructure: 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7
Oracle Corporation Oracle JDeveloper: 12.1.3.0.0, 12.2.1.3.0
Oracle Corporation Primavera Unifier: from 17.1 through 17.12; 16.1, 16.2, 18.8
Oracle Corporation Retail Merchandising System: 15.0, 16.0
Oracle Corporation Oracle WebCenter Portal: 12.2.1.3.0
Red Hat JBoss EAP: 7.2.0
Red Hat OpenShift Container Platform 4.18: 3.11

How to fix

Upgrade to a fixed version: FasterXML jackson-databind 2.6.7.2, 2.7.9.5, 2.8.11.3, 2.9.7. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2018-14720 or the next vulnerability affects your stack