jackson-dataformat-xml vulnerable to server side request forgery (SSRF)

Also known as GHSA-7c2r-3jqf-c9rw

Published 9 y ago 2017-04-14 · modified 4 mo ago 2026-06-17 · JSON

CVSS

8.6

v3.1 · NVD

CISA KEV

not known exploited

EPSS

2.4%

percentile 84%

Public exploits

none known

XmlMapper in the Jackson XML dataformat component (aka jackson-dataformat-xml) before 2.7.8 and 2.8.x before 2.8.4 allows remote attackers to conduct server-side request forgery (SSRF) attacks via vectors related to a DTD.

Exploit prediction (EPSS)

2.36% probability of exploitation in the next 30 days, higher than 84% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.1	8.6	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N`
NVD	2.0	5.0	`AV:N/AC:L/Au:N/C:N/I:P/A:N`
GitHub	3.1	8.6	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N`

Affected packages

Ecosystem	Package	Affected	Fixed in
maven	`com.fasterxml.jackson.dataformat:jackson-dataformat-xml`	<2.7.8 >=2.8.0, <2.8.4	2.7.8 2.8.4

Classification

Weakness

CWE-611 Improper Restriction of XML External Entity Reference
CWE-918 Server-Side Request Forgery

References

github.com /FasterXML/jackson-dataformat-xml/issues/211 · x_refsource_CONFIRM, x_transferred
securityfocus.com /bid/97688 · vdb-entry, x_refsource_BID, x_transferred
bugzilla.redhat.com /show_bug.cgi?id=1378673 · x_refsource_CONFIRM, x_transferred
nvd.nist.gov /vuln/detail/CVE-2016-7051 · advisory
github.com /FasterXML/jackson-dataformat-xml · package
github.com /advisories/GHSA-7c2r-3jqf-c9rw · advisory

Sources

CVE List: CVE-2016-7051
GitHub Advisory: GHSA-7c2r-3jqf-c9rw
NVD: CVE-2016-7051

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.