What is CVE-2017-15095?

jackson-databind in versions prior to 2.8.11 and 2.9.4 contain a deserialization flaw which allows an unauthenticated user to perform code execution by sending maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525, blacklisting additonal vulnerable classes.

What is the severity of CVE-2017-15095?

CVE-2017-15095 has a CVSS v3 score of 9.8, which is classified as Critical severity.

Is there an exploit available for CVE-2017-15095?

No known public exploits are currently available for CVE-2017-15095.

Is there a patch available for CVE-2017-15095?

Yes, patches are available for CVE-2017-15095. Check the vendor advisories for update instructions.

CVE-2017-15095 - CVE Details, Severity, and Analysis

Agentic AI · Pentesting

Ready for Agentic Automated Testing?

Deploy autonomous AI agents that reason, exploit, and validate complex vulnerability chains — not another scanner, an agentic system that thinks like a senior pentester.

Zero false positives

PoC for every finding

30+ tools orchestrated

Book a Demo Learn More

Setup in 5 minutesSOC 2 & ISO 27001

CVE-2017-15095 - CVE Details, Severity, and Analysis | Strobes VI

Trend Analysis

Neutral

Vulnerable Products

Vendor	Product
Oracle	Banking Platform
Oracle	Primavera Unifier
Oracle	Identity Manager
Netapp	Oncommand Balance
Oracle	Communications Diameter Signaling Router
Fasterxml	Jackson Databind
Redhat	Satellite Capsule
Redhat	Enterprise Linux
Oracle	Utilities Advanced Spatial And Operational Analytics
Redhat	Openshift Container Platform

And 15 more...

Advisories

GitHub Advisory Netapp

NVD: A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.