CVE-2019-14439 @ Maven-com.fasterxml.jackson.core:jackson-databind-2.0.4

[cxronen]

Vulnerable Package issue exists @ Maven-com.fasterxml.jackson.core:jackson-databind-2.0.4 in branch master

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before2.10.0.pr2, 2.9.9.2, 2.8.11.4 and 2.7.9.6. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.

Namespace: cxronen
Repository: BookStore_VSCode
Repository Url: https://github.com/cxronen/BookStore_VSCode
CxAST-Project: cxronen/BookStore_VSCode
CxAST platform scan: bd7a4263-ea5f-49fd-8fdb-752c76ed1f15
Branch: master
Application: BookStore_VSCode
Severity: HIGH
State: NOT_IGNORED
Status: NEW
CWE: CWE-200

---

Additional Info
Attack vector: NETWORK
Attack complexity: LOW
Confidentiality impact: HIGH
Availability impact: NONE
Remediation Upgrade Recommendation: 2.6.7.5

---

References
Issue
Commit