jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map — restoring every property _handleByNameInclusion had just removed.
The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4.
Attack Parameters
Impact Assessment
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products 4
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Fasterxml Jackson-Databind
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
|
2.8.0
|
2.18.9
|
|
Fasterxml Jackson-Databind
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
|
2.19.0
|
2.21.5
|
|
Fasterxml Jackson-Databind
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
|
3.0.0
|
3.1.4
|
|
Fasterxml Jackson-Databind
cpe:2.3:a:fasterxml:jackson-databind:2.22.0:*:*:*:*:*:*:*
|
— | — |