CyberRota Analysis
AI-GeneratedThe vulnerability affects the Jackson databind library, specifically in the handling of JSON properties annotated with both @JsonView and @JsonUnwrapped, which can lead to unauthorized data exposure by allowing attacker-controlled JSON to be processed under a less-privileged view. This could result in sensitive information being inadvertently serialized and accessible to unauthorized users. Organizations using affected versions of Jackson databind should prioritize updating to the patched versions to mitigate potential data leakage risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged active view. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.