What is GHSA-7c2r-3jqf-c9rw?

GHSA-7c2r-3jqf-c9rw is a security advisory published by GitHub Security Advisories with High severity. jackson-dataformat-xml vulnerable to server side request forgery (SSRF)

Which CVE IDs does GHSA-7c2r-3jqf-c9rw cover?

GHSA-7c2r-3jqf-c9rw covers the following CVE IDs: CVE-2016-7051. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-7c2r-3jqf-c9rw?

GHSA-7c2r-3jqf-c9rw has a CVSS v3 base score of 8.6, published by GitHub Security Advisories.

Which products are affected by GHSA-7c2r-3jqf-c9rw?

GHSA-7c2r-3jqf-c9rw affects 2 products, including: maven/com.fasterxml.jackson.dataformat:jackson-dataformat-xml:\u003c 2.7.8; maven/com.fasterxml.jackson.dataformat:jackson-dataformat-xml:\u003e= 2.8.0, \u003c 2.8.4.

GHSA-7c2r-3jqf-c9rwHighCVSS 8.6

jackson-dataformat-xml vulnerable to server side request forgery (SSRF)

Vendor

GitHub Security Advisories

Published

October 18, 2018

Last Modified

January 8, 2023

🔗 CVE IDs covered (1)

CVE-2016-7051 →

📋 Description

Versions of jackson-dataformat-xml) prior to 2.7.8 and prior to 2.8.4 allow remote attackers to conduct server-side request forgery (SSRF) attacks via vectors related to a DTD.

🎯 Affected products2

maven/com.fasterxml.jackson.dataformat:jackson-dataformat-xml:< 2.7.8
maven/com.fasterxml.jackson.dataformat:jackson-dataformat-xml:>= 2.8.0, < 2.8.4

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2016-7051
https://github.com/FasterXML/jackson-dataformat-xml/issues/211
https://bugzilla.redhat.com/show_bug.cgi?id=1378673
https://github.com/advisories/GHSA-7c2r-3jqf-c9rw
http://www.securityfocus.com/bid/97688