CVE-2019-12086: Information exposure in FasterXML jackson-databind

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 21.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-05-17 · updated 2026-10-08
Weakness: CWE-502

Description

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpath, and an attacker can host a crafted MySQL server reachable by the victim, an attacker can send a crafted JSON message that allows them to read arbitrary local files on the server. This occurs because of missing com.mysql.cj.jdbc.admin.MiniAdmin validation.

Affected products

Debian Linux: 8.0, 9.0
FasterXML jackson-databind: from 2.0.0 before 2.6.7.3; from 2.7.0 before 2.7.9.6; from 2.8.0 before 2.8.11.4; from 2.9.0 before 2.9.9 — fixed in 2.6.7.3, 2.7.9.6, 2.8.11.4, 2.9.9
Maven Com.Fasterxml.Jackson.Core:Jackson-Databind: from 2.9.0 before 2.9.9; from 2.8.0 before 2.8.11.4; from 2.7.0 before 2.7.9.6; from 2.0.0 before 2.6.7.3; 2.9.0, 2.9.0.pr1, 2.9.0.pr2, 2.9.0.pr3, 2.9.0.pr4, 2.9.1 (+100) — fixed in 2.9.9, 2.8.11.4, 2.7.9.6, 2.6.7.3

How to fix

Upgrade to a fixed version: FasterXML jackson-databind 2.6.7.3, 2.7.9.6, 2.8.11.4, 2.9.9; Maven Com.Fasterxml.Jackson.Core:Jackson-Databind 2.9.9, 2.8.11.4, 2.7.9.6, 2.6.7.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-12086 or the next vulnerability affects your stack