vulnerability

Red Hat JBoss EAP: CVE-2018-19362: Deserialization of Untrusted Data

Try Surface Command

Back to search

Severity	CVSS	Published	Added	Modified
7	(AV:N/AC:L/Au:N/C:P/I:P/A:P)	Nov 18, 2018	Sep 19, 2024	Jul 2, 2025

Severity

CVSS

(AV:N/AC:L/Au:N/C:P/I:P/A:P)

Published

Nov 18, 2018

Added

Sep 19, 2024

Modified

Jul 2, 2025

Description

FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization.. A flaw was discovered in jackson-databind, where it would permit polymorphic deserialization of a malicious object using the jboss-common-core class. An attacker could use this flaw to execute arbitrary code.

Solution

red-hat-jboss-eap-upgrade-latest

References

CWE-502
CVE-2018-19362
https://attackerkb.com/topics/CVE-2018-19362
URL-https://access.redhat.com/security/cve/CVE-2018-19362
URL-https://bugzilla.redhat.com/show_bug.cgi?id=1666489

NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today