Technical impact
jackson‑databind versions from 2.21.0 up to 2.21.3 and all releases prior to 2.21.4 contain a flaw in the BeanDeserializer routine that causes the @JsonView filter to be applied only to creator properties. Setterless Collection or Map properties that are annotated with @JsonView but lack a setter are processed through an unguarded branch, allowing a malicious JSON payload to populate these otherwise restricted properties, thereby bypassing intended visibility or security controls. This flaw corresponds to CWE‑1220 and CWE‑863 and represents a data‑integrity violation within the application.
Affected Systems
The vulnerability affects FasterXML’s jackson‑databind library in versions 2.21.0 through 2.21.3 and in all releases prior to 3.1.4 are listed.
Risk and Exploitability
The CVSS score of 5.3 places the issue in the moderate range. The EPSS score of < 1% suggests a low but nonzero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, indicating no widespread exploitation yet. The attack vector is likely remote; any application that accepts externally supplied JSON and uses jackson‑databind for deserialization can be targeted. By crafting a payload that includes a setterless collection or map annotated with a restricted @JsonView, an attacker can inject data that the application believes to be hidden by view filtering. The exploitation requires only normal JSON input and no special privileges, making the risk tangible for services that rely on @JsonView for access control.
Github GHSA