CVE-2019-12814

Aliases:GHSA-cmfg-87vq-g5g4DEBIAN-CVE-2019-12814CGA-26hh-cwhq-pfg8CGA-2rhp-x999-c93cCGA-3c8h-77p6-pp8rCGA-3jrf-hprc-cq7gCGA-3w2q-rfww-rm4pCGA-3wmm-jq22-22p2CGA-5375-cw3w-hq4xCGA-594r-4hh3-5945CGA-5wmc-xr3f-6m36CGA-6cqg-499v-rrp3CGA-6qm9-hr36-cfx5CGA-7h9h-w8cg-h247CGA-7qq4-cm3r-q29wCGA-88p5-9xrh-22fqCGA-8cf4-84r5-xgg4CGA-9gj7-f4f9-2w5rCGA-c3jw-p4fh-9rxpCGA-cgh2-r68c-74f8CGA-cq4f-f2h4-v2pgCGA-f9qp-5pf8-m969CGA-ffjf-q2qx-3grhCGA-fp46-vcfq-gjr6CGA-gh66-42f3-r9g9CGA-gm94-v4xr-qcq6CGA-gmh9-gm2j-pq26CGA-gvqj-p7hv-r6mxCGA-hmfc-4vrw-7cr4CGA-hr56-jc2h-4ch2CGA-jgxh-m8c7-3rxhCGA-m99j-p5fw-8xxmCGA-mj39-xqpc-v4gvCGA-mqxq-2h3m-4343CGA-q4h2-j8fv-7w62CGA-q692-rp4j-2xf8CGA-qc5x-v3jg-52p2CGA-qxfg-4vxx-v9jjCGA-r4fg-2ff2-jj74CGA-rr77-xc6g-3j3xCGA-v2v4-rm9w-v2f5CGA-xrw2-4hj6-3c6hCGA-2g2g-rwjj-92w3CGA-2w3r-3rq4-5jg6CGA-4f4p-j586-39pqCGA-4vf8-m9qg-hvpgCGA-6x72-3ggj-mxrjCGA-746g-fjr2-8wxvCGA-8ghv-qx3w-h2jvCGA-8mvw-7mp4-333xCGA-8r63-8h3v-pvfrCGA-h67h-5vw4-jh84CGA-j5wr-wgj2-xf3jCGA-m548-m3vc-jvj3CGA-pr5g-977j-897gCGA-qh74-hg3v-j9mxCGA-rmhm-7mvf-9r8vCGA-v7c4-x3h4-447xCGA-vvm3-5fmp-fw2cCGA-wc92-h485-2gmcCGA-wf2f-qh27-69vvCGA-xq2m-rgpv-447vCGA-22rv-fcjj-f7cvCGA-275f-xrww-pc2jCGA-28r4-23fm-6m9mCGA-2gcj-3752-42x7CGA-35pv-wpw4-prw6CGA-3fpg-qjx9-vvwgCGA-3gm5-vgcp-r3m3CGA-3h7w-h43m-mg4fCGA-3pm3-mxpj-whh7CGA-4q6h-j836-v9r5CGA-5693-8pp2-jfchCGA-5h9c-27hh-vcrhCGA-6w2h-rc98-qjc4CGA-8v4q-rr86-56p2CGA-8wjp-5gx5-2wvcCGA-93hj-2v35-3r6jCGA-94f9-qv2m-v396CGA-9pfc-3h73-cfgcCGA-c23v-xqr9-q7gmCGA-c3h7-8mwp-wfchCGA-cjgg-5pwf-83jhCGA-cwmj-78gh-86fjCGA-fgqh-cpjf-cc6xCGA-g9x4-95w2-7vjrCGA-hx32-9384-qwhvCGA-mp6c-543v-g324CGA-mx48-cwh3-pwfwCGA-q23c-p8v6-mqg6CGA-qfm9-vjv3-w4gjCGA-qrmc-jx47-5fvgCGA-r62c-gpr8-pw3wCGA-rx7w-7vx9-v94mCGA-v698-42f5-2p5jCGA-vfx5-5x56-x4cvCGA-vqc9-xjhh-jrcgCGA-wjj7-vcrw-hw9jCGA-x7g7-4m99-6h3hCGA-x8j3-432f-pvqqCGA-2v5x-85hv-r7fhCGA-2xrj-7p4x-54hhCGA-4xhq-4prw-x392CGA-5jv2-4f7c-7c67CGA-6cx6-m6hw-f37gCGA-6h6m-7x5v-v7fqCGA-7jwg-8f88-hvx6CGA-7mg8-jhjf-r6cjCGA-896x-qhmx-6chgCGA-8rrc-4crp-c6f6CGA-97x3-6whm-447hCGA-9f9m-f3q3-3rxhCGA-c8x9-hxrp-hw8hCGA-cjx5-vhqh-7538CGA-fr39-hj6r-353wCGA-g3vg-65c9-x2rhCGA-gcwq-2qg9-j5hjCGA-gjpf-4xvx-wjx5CGA-m269-8mw7-2j8cCGA-m8ww-pq2c-7h93CGA-pcvj-32px-m6rvCGA-pf7q-q3rh-25qcCGA-pf8h-cjw7-fqx8CGA-pqvp-rpcj-p6mgCGA-q3xq-8x43-xvgvCGA-qjf6-hfm2-hxqcCGA-qwf9-7p4q-m828CGA-rg24-5gv4-xwvqCGA-rhjp-wwjg-xg3hCGA-vj8q-hgq2-45frCGA-wh38-99rv-pv88CGA-wpjm-7c6g-7hrv
Advisory lineage Upstream: 0 Downstream: 12
Modified
Published: 19 Jun 2019, 13:24
Last modified:27 Aug 2025, 20:30

Vulnerability Summary

Overall Risk (default)
medium
26/100
CVSS Score
5.9 MEDIUM
v3.1 (cve.org)
EPSS Score
10.9% MEDIUM
11% probability -7.44%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

19 Jun 2019, 13:24
Published
Vulnerability first disclosed
27 Aug 2025, 20:30
Last Modified
Vulnerability information updated

Description

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has JDOM 1.x or 2.x jar in the classpath, an attacker can send a specifically crafted JSON message that allows them to read arbitrary local files on the server.

CVSS Metrics

  • v3.1•MEDIUM•Score: 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
  • v3.0•MEDIUM•Score: 5.9CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
  • v2.0•MEDIUM•Score: 4.3AV:N/AC:M/Au:N/C:P/I:N/A:N

EPSS Trends

Current EPSS score: 10.90%• Percentile: 96%

Techniques & Countermeasures

  • CWE-502•Deserialization of Untrusted Data

    The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Affected Systems

  • chainguard•eco-java-gradle-2.10

    all

  • chainguard•eco-java-gradle-2.11

    all

  • chainguard•eco-java-gradle-2.12

    all

  • chainguard•eco-java-gradle-2.13

    all

  • chainguard•eco-java-gradle-2.14

    all

  • chainguard•eco-java-gradle-2.14.1

    all

  • chainguard•eco-java-gradle-2.4

    all

  • chainguard•eco-java-gradle-2.5

    all

  • chainguard•eco-java-gradle-2.6

    all

  • chainguard•eco-java-gradle-2.7

    all

  • chainguard•eco-java-gradle-2.8

    all

  • chainguard•eco-java-gradle-2.9

    all

  • chainguard•eco-java-gradle-3.0

    all

  • chainguard•eco-java-gradle-3.1

    all

  • chainguard•eco-java-gradle-3.2

    all

  • chainguard•eco-java-gradle-3.2.1

    all

  • chainguard•eco-java-gradle-3.3

    all

  • chainguard•eco-java-gradle-3.4

    all

  • chainguard•eco-java-gradle-3.4.1

    all

  • chainguard•eco-java-gradle-3.5

    all

  • chainguard•eco-java-gradle-3.5.1

    all

  • chainguard•eco-java-gradle-4.0

    all

  • chainguard•eco-java-gradle-4.0.1

    all

  • chainguard•eco-java-gradle-4.0.2

    all

  • chainguard•eco-java-gradle-4.1

    all

  • chainguard•eco-java-gradle-4.10

    all

  • chainguard•eco-java-gradle-4.10.1

    all

  • chainguard•eco-java-gradle-4.10.2

    all

  • chainguard•eco-java-gradle-4.10.3

    all

  • chainguard•eco-java-gradle-4.2

    all

  • chainguard•eco-java-gradle-4.2.1

    all

  • chainguard•eco-java-gradle-4.3

    all

  • chainguard•eco-java-gradle-4.3.1

    all

  • chainguard•eco-java-gradle-4.4

    all

  • chainguard•eco-java-gradle-4.4.1

    all

  • chainguard•eco-java-gradle-4.5

    all

  • chainguard•eco-java-gradle-4.5.1

    all

  • chainguard•eco-java-gradle-4.6

    all

  • chainguard•eco-java-gradle-4.7

    all

  • chainguard•eco-java-gradle-4.8

    all

  • chainguard•eco-java-gradle-4.8.1

    all

  • chainguard•eco-java-gradle-4.9

    all

  • chainguard•eco-java-gradle-5.0

    all

  • chainguard•eco-java-gradle-5.1

    all

  • chainguard•eco-java-gradle-5.1.1

    all

  • chainguard•eco-java-gradle-5.2

    all

  • chainguard•eco-java-gradle-5.2.1

    all

  • chainguard•eco-java-gradle-5.3

    all

  • chainguard•eco-java-gradle-5.3.1

    all

  • chainguard•eco-java-gradle-5.4

    all

Showing first 50 affected entries in server-rendered view.

References (94)