XmlMapper in the Jackson XML dataformat component (aka jackson-dataformat-xml) before 2.7.8 and 2.8.x before 2.8.4 allows remote attackers to conduct server-side request forgery (SSRF) attacks via vectors related to a DTD.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| com.fasterxml.jackson.dataformat:jackson-dataformat-xml(Maven) | 0 | 2.7.8 | N/A |
| com.fasterxml.jackson.dataformat:jackson-dataformat-xml(Maven) | 2.8.0 | 2.8.4 | N/A |
CVSS Metrics
