fasterxml/jackson-dataformat-xml · Security
jackson-dataformat-xml vulnerable to server side request forgery (SSRF)
- GHSA ID
- GHSA-7c2r-3jqf-c9rw
- CVE ID
- CVE-2016-7051
- Severity
- high
- Published
- Updated
- CVSS
- 8.6 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
- CVSS v3
- 8.6 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Description
Versions of jackson-dataformat-xml) prior to 2.7.8 and prior to 2.8.4 allow remote attackers to conduct server-side request forgery (SSRF) attacks via vectors related to a DTD.
CWEs
- CWE-611 · Improper Restriction of XML External Entity Reference
- CWE-918 · Server-Side Request Forgery (SSRF)