Vulnerability Name: CVE-2017-7525 (CCN-134639) Assigned: 2017-11-08 Published: 2017-11-08 Updated: 2023-06-08 Summary: Apache Struts could allow a remote attacker to execute arbitrary code on the system, caused by a deserialization flaw within the Jackson JSON library in the readValue method of the ObjectMapper. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system. CVSS v3 Severity: 9.8 Critical (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 8.5 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitability Metrics: Attack Vector (AV): NetworkAttack Complexity (AC): LowPrivileges Required (PR): NoneUser Interaction (UI): NoneScope: Scope (S): UnchangedImpact Metrics: Confidentiality (C): HighIntegrity (I): HighAvailibility (A): High
9.8 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 8.5 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitability Metrics: Attack Vector (AV): NetworkAttack Complexity (AC): LowPrivileges Required (PR): NoneUser Interaction (UI): NoneScope: Scope (S): UnchangedImpact Metrics: Confidentiality (C): HighIntegrity (I): HighAvailibility (A): High
CVSS v2 Severity: 7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P Exploitability Metrics: Access Vector (AV): NetworkAccess Complexity (AC): LowAuthentication (Au): NoneImpact Metrics: Confidentiality (C): PartialIntegrity (I): PartialAvailibility (A): Partial
10.0 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C Exploitability Metrics: Access Vector (AV): NetworkAccess Complexity (AC): LowAthentication (Au): NoneImpact Metrics: Confidentiality (C): CompleteIntegrity (I): CompleteAvailibility (A): Complete
Vulnerability Consequences: Gain Access References: Source: MITRECVE-2017-7525 IBM Cognos Business Intelligence Server 2018Q2 Security Updater : IBM Cognos Business Intelligence Server is affected by multiple vulnerabilities Multiple vulnerabilities in IBM Cognos Business Intelligence affect Rational Reporting for Development Intelligence Multiple vulnerabilities in IBM Cognos Business Intelligence affect Rational Insight Security vulnerabilities affect multiple IBM Rational products based on IBM Jazz technology IBM InfoSphere Change Data Capture is affected by a Jackson 2.3.3 and 2.4.4 open source library vulnerabilities Remote code execution vulnerability within Jackson JSON library affects IBM Business Process Manager (CVE-2017-7525) IBM Security Guardium is affected by Open Source Apache Struts 2.5 Vulnerability (CVE-2017-7525 ) Multiple vulnerabilities in Jackson-databind affect IBM InfoSphere Information Server Oracle Critical Patch Update Advisory - April 2018 secalert@redhat.com Oracle Critical Patch Update Advisory - July 2018 secalert@redhat.com secalert@redhat.com FasterXML Jackson-databind CVE-2017-7525 Deserialization Remote Code Execution Vulnerability secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com (CVE-2017-7525) CVE-2017-7525 jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper secalert@redhat.com Vulnerability in the Jackson JSON library secalert@redhat.com apache-struts-cve20177525-code-exec(134639) jackson-databind secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com Multiple vulnerabilities affect IBM PureApplication System IBM Cognos Business Intelligence Server 2018Q2 Security Updater : IBM Cognos Business Intelligence Server is affected by multiple vulnerabilities secalert@redhat.com Multiple vulnerabilities affect IBM Rational Design Manager Multiple Vulnerabilities in IBM Cognos Analytics IBM has announced a release for IBM Security Identity Governance and Intelligence in response to multiple security vulnerabilities Apache Struts Vulnerability Affects IBM Campaign and IBM Contact Optimization (CVE-2017-7525) IBM has announced a release for IBM Security Identity Governance and Intelligence in response to security vulnerabilities. IBM Data Risk Manager is affected by multiple vulnerabilities IBM Maximo Asset Management is vulnerable to Multiple Jackson-Databind CVEs - February 2020 Multiple Vulnerabilities in Jackson Core affect IBM Maximo Asset Management Multiple Vulnerabilities in IBM Guardium Data Encryption (GDE) IBM Cognos Command Center is affected by multiple vulnerabilities secalert@redhat.com secalert@redhat.com secalert@redhat.com secalert@redhat.com Vulnerable Configuration: Configuration CCN 1 :cpe:/a:apache:struts:2.5:*:*:*:*:*:*:* OR cpe:/a:apache:struts:2.5.10:*:*:*:*:*:*:* OR cpe:/a:apache:struts:2.5.11:*:*:*:*:*:*:* OR cpe:/a:apache:struts:2.5.12:*:*:*:*:*:*:* OR cpe:/a:apache:struts:2.5.5:*:*:*:*:*:*:* OR cpe:/a:apache:struts:2.5.1:*:*:*:*:*:*:* OR cpe:/a:apache:struts:2.5.2:*:*:*:*:*:*:* OR cpe:/a:apache:struts:2.5.8:*:*:*:*:*:*:* OR cpe:/a:apache:struts:2.5.10.1:*:*:*:*:*:*:* OR cpe:/a:apache:struts:2.5.13:*:*:*:*:*:*:* OR cpe:/a:apache:struts:2.5.14:*:*:*:*:*:*:* OR cpe:/a:apache:struts:2.5.16:*:*:*:*:*:*:* OR cpe:/a:apache:struts:2.5.4:*:*:*:*:*:*:* OR cpe:/a:apache:struts:2.5.6:*:*:*:*:*:*:* OR cpe:/a:apache:struts:2.5.7:*:*:*:*:*:*:* OR cpe:/a:apache:struts:2.5.9:*:*:*:*:*:*:* AND cpe:/a:ibm:cognos_business_intelligence:10.2.1:*:*:*:*:*:*:* OR cpe:/a:ibm:cognos_business_intelligence:10.2.1.1:*:*:*:*:*:*:* OR cpe:/a:ibm:rational_rhapsody_design_manager:5.0:*:*:*:*:*:*:* OR cpe:/a:ibm:infosphere_information_server:11.3:*:*:*:*:*:*:* OR cpe:/a:ibm:rational_collaborative_lifecycle_management:5.0:*:*:*:*:*:*:* OR cpe:/a:ibm:rational_reporting:5.0:*:*:*:development_intelligence:*:*:* OR cpe:/a:ibm:rational_reporting:5.0.1:*:*:*:development_intelligence:*:*:* OR cpe:/a:ibm:rational_insight:1.1.1.4:*:*:*:*:*:*:* OR cpe:/a:ibm:rational_insight:1.1.1.5:*:*:*:*:*:*:* OR cpe:/a:ibm:rational_collaborative_lifecycle_management:5.0.1:*:*:*:*:*:*:* OR cpe:/a:ibm:cognos_business_intelligence:10.2.2:*:*:*:*:*:*:* OR cpe:/a:ibm:maximo_asset_management:7.6.0:*:*:*:*:*:*:* OR cpe:/a:ibm:rational_collaborative_lifecycle_management:5.0.2:*:*:*:*:*:*:* OR cpe:/a:ibm:rational_insight:1.1.1.6:*:*:*:*:*:*:* OR cpe:/a:ibm:rational_reporting:5.0.2:*:*:*:development_intelligence:*:*:* OR cpe:/a:ibm:rational_insight:1.1.1.7:*:*:*:*:*:*:* OR cpe:/a:ibm:rational_collaborative_lifecycle_management:6.0:*:*:*:*:*:*:* OR cpe:/a:ibm:infosphere_information_server:11.5:*:*:*:*:*:*:* OR cpe:/a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:* OR cpe:/a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:* OR cpe:/a:ibm:security_identity_governance_and_intelligence:5.2:*:*:*:*:*:*:* OR cpe:/a:ibm:cognos_analytics:11:*:*:*:*:*:*:* OR cpe:/a:ibm:rational_collaborative_lifecycle_management:6.0.1:*:*:*:*:*:*:* OR cpe:/a:ibm:security_identity_governance_and_intelligence:5.2.1:*:*:*:*:*:*:* OR cpe:/a:ibm:rational_collaborative_lifecycle_management:6.0.2:*:*:*:*:*:*:* OR cpe:/a:ibm:rational_collaborative_lifecycle_management:6.0.3:*:*:*:*:*:*:* OR cpe:/a:ibm:rational_rhapsody_design_manager:6.0:*:*:*:*:*:*:* OR cpe:/a:ibm:rational_rhapsody_design_manager:6.0.1:*:*:*:*:*:*:* OR cpe:/a:ibm:rational_rhapsody_design_manager:6.0.2:*:*:*:*:*:*:* OR cpe:/a:ibm:rational_rhapsody_design_manager:6.0.3:*:*:*:*:*:*:* OR cpe:/a:ibm:pureapplication_system:2.2.3.0:*:*:*:*:*:*:* OR cpe:/a:ibm:rational_collaborative_lifecycle_management:6.0.4:*:*:*:*:*:*:* OR cpe:/a:ibm:pureapplication_system:2.2.3.1:*:*:*:*:*:*:* OR cpe:/a:ibm:pureapplication_system:2.2.3.2:*:*:*:*:*:*:* OR cpe:/a:oracle:weblogic_server:12.2.1.2.0:*:*:*:*:*:*:* OR cpe:/a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:* OR cpe:/a:ibm:pureapplication_system:2.2.4.0:*:*:*:*:*:*:* OR cpe:/a:ibm:business_process_manager:8.6:*:*:*:*:*:*:* OR cpe:/a:ibm:rational_collaborative_lifecycle_management:6.0.5:*:*:*:*:*:*:* OR cpe:/a:ibm:rational_rhapsody_design_manager:6.0.4:*:*:*:*:*:*:* OR cpe:/a:ibm:security_guardium:10.1.4:*:*:*:*:*:*:* OR cpe:/a:ibm:infosphere_information_server:11.7:*:*:*:*:*:*:* OR cpe:/a:ibm:contact_optimization:9.1.2:*:*:*:*:*:*:* OR cpe:/a:ibm:rational_rhapsody_design_manager:6.0.5:*:*:*:*:*:*:* OR cpe:/a:ibm:pureapplication_system:2.2.5.0:*:*:*:*:*:*:* OR cpe:/a:ibm:pureapplication_system:2.2.5.1:*:*:*:*:*:*:* OR cpe:/a:ibm:security_identity_governance_and_intelligence:5.2.2:*:*:*:*:*:*:* OR cpe:/a:ibm:security_identity_governance_and_intelligence:5.2.2.1:*:*:*:*:*:*:* OR cpe:/a:ibm:security_identity_governance_and_intelligence:5.2.3:*:*:*:*:*:*:* OR cpe:/a:ibm:security_identity_governance_and_intelligence:5.2.3.1:*:*:*:*:*:*:* OR cpe:/a:ibm:security_identity_governance_and_intelligence:5.2.3.2:*:*:*:*:*:*:* OR cpe:/a:ibm:cognos_business_intelligence_server:10.2.0:*:*:*:*:*:*:* OR cpe:/a:ibm:cognos_business_intelligence_server:10.2.1:*:*:*:*:*:*:* OR cpe:/a:ibm:cognos_business_intelligence_server:10.2.1.1:*:*:*:*:*:*:* OR cpe:/a:ibm:cognos_business_intelligence_server:10.2.2:*:*:*:*:*:*:* OR cpe:/a:ibm:maximo_asset_management:7.6.1:*:*:*:*:*:*:* OR cpe:/a:ibm:cognos_business_intelligence:10.2.0:*:*:*:*:*:*:* OR cpe:/a:ibm:security_identity_governance_and_intelligence:5.2.4:*:*:*:*:*:*:* OR cpe:/a:ibm:rational_rhapsody_design_manager:6.0.6:*:*:*:*:*:*:* OR cpe:/a:ibm:rational_collaborative_lifecycle_management:6.0.6:*:*:*:*:*:*:* OR cpe:/a:ibm:rational_rhapsody_design_manager:5.01:*:*:*:*:*:*:* OR cpe:/a:ibm:rational_rhapsody_design_manager:5.02:*:*:*:*:*:*:* OR cpe:/a:ibm:pureapplication_system:2.2.5.2:*:*:*:*:*:*:* OR cpe:/a:ibm:contact_optimization:9.1.0:*:*:*:*:*:*:* OR cpe:/a:ibm:contact_optimization:10.1:*:*:*:*:*:*:* OR cpe:/a:ibm:pureapplication_system:2.2.5.3:*:*:*:*:*:*:* OR cpe:/a:ibm:infosphere_data_replication:11.4:*:*:*:*:*:*:* OR cpe:/a:ibm:security_identity_governance_and_intelligence:5.2.4.1:*:*:*:*:*:*:* OR cpe:/a:ibm:cognos_command_center:10.2.4.1:*:*:*:*:*:*:* OR cpe:/a:ibm:contact_optimization:11.0:*:*:*:*:*:*:* OR cpe:/a:ibm:data_risk_manager:2.0.6:*:*:*:*:*:*:* OR cpe:/a:ibm:security_identity_governance_and_intelligence:5.2.6:*:*:*:*:*:*:* OR cpe:/a:ibm:security_guardium_data_encryption:3.0.0.2:*:*:*:*:*:*:* Oval Definitions BACK
apache struts 2.5
apache struts 2.5.10
apache struts 2.5.11
apache struts 2.5.12
apache struts 2.5.5
apache struts 2.5.1
apache struts 2.5.2
apache struts 2.5.8
apache struts 2.5.10.1
apache struts 2.5.13
apache struts 2.5.14
apache struts 2.5.16
apache struts 2.5.4
apache struts 2.5.6
apache struts 2.5.7
apache struts 2.5.9
ibm cognos business intelligence 10.2.1
ibm cognos business intelligence 10.2.1.1
ibm rational rhapsody design manager 5.0
ibm infosphere information server 11.3
ibm rational collaborative lifecycle management 5.0
ibm rational reporting 5.0
ibm rational reporting 5.0.1
ibm rational insight 1.1.1.4
ibm rational insight 1.1.1.5
ibm rational collaborative lifecycle management 5.0.1
ibm cognos business intelligence 10.2.2
ibm maximo asset management 7.6.0
ibm rational collaborative lifecycle management 5.0.2
ibm rational insight 1.1.1.6
ibm rational reporting 5.0.2
ibm rational insight 1.1.1.7
ibm rational collaborative lifecycle management 6.0
ibm infosphere information server 11.5
oracle weblogic server 10.3.6.0.0
oracle weblogic server 12.1.3.0.0
ibm security identity governance and intelligence 5.2
ibm cognos analytics 11
ibm rational collaborative lifecycle management 6.0.1
ibm security identity governance and intelligence 5.2.1
ibm rational collaborative lifecycle management 6.0.2
ibm rational collaborative lifecycle management 6.0.3
ibm rational rhapsody design manager 6.0
ibm rational rhapsody design manager 6.0.1
ibm rational rhapsody design manager 6.0.2
ibm rational rhapsody design manager 6.0.3
ibm pureapplication system 2.2.3.0
ibm rational collaborative lifecycle management 6.0.4
ibm pureapplication system 2.2.3.1
ibm pureapplication system 2.2.3.2
oracle weblogic server 12.2.1.2.0
oracle weblogic server 12.2.1.3.0
ibm pureapplication system 2.2.4.0
ibm business process manager 8.6
ibm rational collaborative lifecycle management 6.0.5
ibm rational rhapsody design manager 6.0.4
ibm security guardium 10.1.4
ibm infosphere information server 11.7
ibm contact optimization 9.1.2
ibm rational rhapsody design manager 6.0.5
ibm pureapplication system 2.2.5.0
ibm pureapplication system 2.2.5.1
ibm security identity governance and intelligence 5.2.2
ibm security identity governance and intelligence 5.2.2.1
ibm security identity governance and intelligence 5.2.3
ibm security identity governance and intelligence 5.2.3.1
ibm security identity governance and intelligence 5.2.3.2
ibm cognos business intelligence server 10.2.0
ibm cognos business intelligence server 10.2.1
ibm cognos business intelligence server 10.2.1.1
ibm cognos business intelligence server 10.2.2
ibm maximo asset management 7.6.1
ibm cognos business intelligence 10.2.0
ibm security identity governance and intelligence 5.2.4
ibm rational rhapsody design manager 6.0.6
ibm rational collaborative lifecycle management 6.0.6
ibm rational rhapsody design manager 5.01
ibm rational rhapsody design manager 5.02
ibm pureapplication system 2.2.5.2
ibm contact optimization 9.1.0
ibm contact optimization 10.1
ibm pureapplication system 2.2.5.3
ibm infosphere data replication 11.4
ibm security identity governance and intelligence 5.2.4.1
ibm cognos command center 10.2.4.1
ibm contact optimization 11.0
ibm data risk manager 2.0.6
ibm security identity governance and intelligence 5.2.6
ibm security guardium data encryption 3.0.0.2
Denotes that component is vulnerable