CVE-2016-7051: XEE
A flaw was found in jackson-dataformat-xml's XmlMapper which allows XXE Out of Band attack. An attacker could use this flaw to launch a SSRF attack.
Other sources
XmlMapper in the Jackson XML dataformat component (aka jackson-dataformat-xml) before 2.7.8 and 2.8.x before 2.8.4 allows remote attackers to conduct server-side request forgery (SSRF) attacks via vectors related to a DTD.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-7051?
CVE-2016-7051 has a high severity rating due to its potential to allow remote code execution through SSRF attacks.
How do I fix CVE-2016-7051?
To fix CVE-2016-7051, upgrade jackson-dataformat-xml to version 2.7.8 or later, or 2.8.4 or later.
What type of attacks can CVE-2016-7051 facilitate?
CVE-2016-7051 can facilitate XXE Out of Band attacks, which can lead to SSRF vulnerabilities.
Which versions of jackson-dataformat-xml are affected by CVE-2016-7051?
CVE-2016-7051 affects versions of jackson-dataformat-xml before 2.7.8 and 2.8.x before 2.8.4.
Is CVE-2016-7051 a known vulnerability?
Yes, CVE-2016-7051 is a documented vulnerability that was reported and categorized due to its security implications.