Technical impact
jackson-databind contains a flaw where unwrapped creator parameters annotated with @JsonView and @JsonUnwrapped are populated from incoming JSON regardless of the active view, bypassing the intended visibility restrictions. This allows an attacker to obtain data that should have been hidden, leading to unauthorized information disclosure. The weakness is classified as CWE-863 and CWE-639, reflecting an authorization bypass and unauthorized modification of data through user-controlled keys.
Affected Systems
The vulnerability affects FasterXML jackson-databind versions 2.21.0 through 2.21.3 and any releases prior to 3.1.4. The fix is included in jackson-databind 2.21.4 and 3.1.4 (and later). Systems using these libraries for JSON deserialization are at risk when “@JsonUnwrapped” is combined with “@JsonView”.
Risk and Exploitability
The CVSS score of 6.5 indicates a medium severity. EPSS is < 1%, indicating a very low probability of exploitation, and the lack of a KEV listing suggests no widely known active exploits yet. The vulnerability can be triggered by crafting JSON payloads that include unwrapped properties; the deserialization process will deserialize them into constructor parameters without enforcing view visibility, potentially exposing sensitive data. The attack requires the attacker to supply a JSON document to an application that uses the vulnerable deserialization path, and succeeds even when a more restrictive view is activated.
Github GHSA