CVE-2016-7051

CWE-611 — XML External Entity (XXE)CWE-918 — Server-Side Request Forgery (SSRF)9 documents6 sources
Severity
8.6HIGH
EPSS
0.9%
top 24.06%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Fasterxml Jackson-dataformat-xml
Timeline
PublishedApr 14
Latest updateOct 18

Description

XmlMapper in the Jackson XML dataformat component (aka jackson-dataformat-xml) before 2.7.8 and 2.8.x before 2.8.4 allows remote attackers to conduct server-side request forgery (SSRF) attacks via vectors related to a DTD.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:NExploitability: 3.9 | Impact: 4.0

Affected Packages3 packages

▶Debianjackson-dataformat-xml< 2.8.5-1+3

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
GHSA
jackson-dataformat-xml vulnerable to server side request forgery (SSRF)↗2018-10-18
▶
OSV
jackson-dataformat-xml vulnerable to server side request forgery (SSRF)↗2018-10-18
▶
OSV
CVE-2016-7051: XmlMapper in the Jackson XML dataformat component (aka jackson-dataformat-xml) before 2↗2017-04-14
▶
CVEList
CVE-2016-7051: XmlMapper in the Jackson XML dataformat component (aka jackson-dataformat-xml) before 2↗2017-04-14
▶

📋Vendor Advisories

1
Debian
CVE-2016-7051: jackson-dataformat-xml - XmlMapper in the Jackson XML dataformat component (aka jackson-dataformat-xml) b...↗2016
▶

💬Community

3
Bugzilla
CVE-2016-7051 jberet: jackson-dataformat-xml: XmlMapper is vulnerable to SSRF attack [fedora-all]↗2016-09-28
▶
Bugzilla
CVE-2016-7051 jackson-dataformat-xml: XmlMapper is vulnerable to SSRF attack [fedora-all]↗2016-09-28
▶
Bugzilla
CVE-2016-7051 jackson-dataformat-xml: XmlMapper is vulnerable to SSRF attack↗2016-09-23
▶
CVE-2016-7051 (HIGH CVSS 8.6) | XmlMapper in the Jackson XML datafo | cvebase.io