CVE-2016-7051: fasterxml jackson-dataformat-xml
CVSS: 8.6v3.1HighModified
AliasesUBUNTU-CVE-2016-7051DEBIAN-CVE-2016-7051GHSA-7c2r-3jqf-c9rw
Published 14-04-2017Last modified 06-08-2024
Vulnerability summary
CVE-2016-7051 is a high (CVSS 8.6) vulnerability in fasterxml jackson-dataformat-xml. EPSS estimates a 2.36% chance of exploitation in the next 30 days, higher than 83.4% of scored vulnerabilities.
CVSS score
8.6/10
010
High · v3.1 (NVD)EPSS score
2.36%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 14-04-2017PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
XmlMapper in the Jackson XML dataformat component (aka jackson-dataformat-xml) before 2.7.8 and 2.8.x before 2.8.4 allows remote attackers to conduct server-side request forgery (SSRF) attacks via vectors related to a DTD.
CVSS metrics
5 scores · 4 sources · 2 versionsHigh 8.6Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:NSourcesAll 4 agree
- OSV · UbuntuEcosystem advisory · calculated8.6HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated8.6HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
- OSV · MavenEcosystem advisory · calculated8.6HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:P/A:NSourcesSingle source
EPSS trend
Probability
2.36%
Chance of exploitation in the next 30 days
Percentile
83%
Versus all other CVEs
30-day change
0.00 pp
From 2.36% on 18-09-2026
18-09-202618-10-2026
EPSS score2.36%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-611Improper Restriction of XML External Entity ReferenceThe product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
- CWE-918Server-Side Request Forgery (SSRF)The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Affected systems
Com.fasterxml.jackson.dataformat1 product
- jackson-dataformat-xml< 2.7.8 | ≥ 2.8.0, < 2.8.4
Debian1 product
- jackson-dataformat-xml< 2.8.5-1
Fasterxml1 product
- jackson-dataformat-xml< 2.7.8 | 2.8.0 | 2.8.0:rc1 | 2.8.0:rc2 | 2.8.1 | 2.8.2 | 2.8.3
Ubuntu1 product
- jackson-dataformat-xmlAll versions (No fix recorded)
4 vendors · 4 products
References
9 links- github.com/FasterXML/jackson-dataformat-xml/issues/211X Refsource CONFIRMIssue TrackingPatchThird Party AdvisoryWEB
- bugzilla.redhat.com/show_bug.cgi?id=1378673X Refsource CONFIRMIssue TrackingThird Party AdvisoryVDB EntryREPORTWEB
