com.fasterxml.jackson.dataformat/jackson-dataformat-xml vulnerabilities

Latest com.fasterxml.jackson.dataformat/jackson-dataformat-xml CVEs

Newest publication first

1. CVE-2016-7051 jackson-dataformat-xml vulnerable to server side request forgery (SSRF)

   Published 2017-04-14

   High·CVSS 8.6 EPSS 2.4%

   XmlMapper in the Jackson XML dataformat component (aka jackson-dataformat-xml) before 2.7.8 and 2.8.x before 2.8.4 allows remote attackers to conduct server-side request forgery (SSRF) attacks via vectors related to a DTD.

2. CVE-2016-3720 jackson-dataformat-xml vulnerable to XML external entity (XXE)

   Published 2016-06-10

   Critical·CVSS 9.8 EPSS 2.8%

   XML external entity (XXE) vulnerability in XmlMapper in the Data format extension for Jackson (aka jackson-dataformat-xml) allows attackers to have unspecified impact via unknown vectors.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.