CVE-2016-7051

moderate-risk

Published 2017-04-14

XmlMapper in the Jackson XML dataformat component (aka jackson-dataformat-xml) before 2.7.8 and 2.8.x before 2.8.4 allows remote attackers to conduct server-side request forgery (SSRF) attacks via vectors related to a DTD.

Do I need to act?

0.92% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 8.6/10 High

NETWORK / LOW complexity

Affected Products (7)

Jackson-Dataformat-Xml

Affected Vendors

Fasterxml

References (6)

Third Party Advisory http://www.securityfocus.com/bid/97688

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1378673

Issue Tracking https://github.com/FasterXML/jackson-dataformat-xml/issues/211

Third Party Advisory http://www.securityfocus.com/bid/97688

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1378673

Issue Tracking https://github.com/FasterXML/jackson-dataformat-xml/issues/211

/ 100

moderate-risk

Severity 29/34 · Critical

Exploitability 3/34 · Minimal

Exposure 14/34 · Moderate