VulnerableCode Vulnerability Details

Search for vulnerabilities

Vulnerability details: VCID-s2hq-5z79-aaab

Essentials
Severities (99)
References (16)
Severity details (12)
Exploits (0)
EPSS
History (0)

Vulnerability ID	VCID-s2hq-5z79-aaab
Aliases	CVE-2016-7051 GHSA-7c2r-3jqf-c9rw
Summary	Moderate severity vulnerability that affects com.fasterxml.jackson.dataformat:jackson-dataformat-xml
Status	Published
Exploitability	0.5
Weighted Severity	8.0
Risk	4.0
Affected and Fixed Packages	Package Details

Weaknesses (4)

CWE-611	Improper Restriction of XML External Entity Reference
CWE-918	Server-Side Request Forgery (SSRF)
CWE-1035	OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937	OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities

System	Score	Found at
epss	0.00181	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00181	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00181	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00181	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00189	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00189	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00189	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00189	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00189	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00189	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00189	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00189	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00189	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00189	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00189	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00189	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.00543	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
epss	0.01024	https://api.first.org/data/v1/epss?cve=CVE-2016-7051
cvssv3.1	8.6	https://bugzilla.redhat.com/show_bug.cgi?id=1378673
generic_textual	HIGH	https://bugzilla.redhat.com/show_bug.cgi?id=1378673
cvssv3.1_qr	HIGH	https://github.com/advisories/GHSA-7c2r-3jqf-c9rw
cvssv3.1	8.6	https://github.com/FasterXML/jackson-dataformat-xml
generic_textual	HIGH	https://github.com/FasterXML/jackson-dataformat-xml
cvssv3.1	8.6	https://github.com/FasterXML/jackson-dataformat-xml/issues/211
generic_textual	HIGH	https://github.com/FasterXML/jackson-dataformat-xml/issues/211
cvssv2	5.0	https://nvd.nist.gov/vuln/detail/CVE-2016-7051
cvssv3	8.6	https://nvd.nist.gov/vuln/detail/CVE-2016-7051
cvssv3.1	8.6	https://nvd.nist.gov/vuln/detail/CVE-2016-7051
cvssv3.1	8.6	http://www.securityfocus.com/bid/97688
generic_textual	HIGH	http://www.securityfocus.com/bid/97688

Reference id	Reference type	URL
		https://api.first.org/data/v1/epss?cve=CVE-2016-7051
		https://bugzilla.redhat.com/show_bug.cgi?id=1378673
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7051
		https://github.com/FasterXML/jackson-dataformat-xml
		https://github.com/FasterXML/jackson-dataformat-xml/commit/eeff2c312e9d4caa8c9f27b8f740c7529d00524a
		https://github.com/FasterXML/jackson-dataformat-xml/issues/211
		http://www.securityfocus.com/bid/97688
cpe:2.3:a:fasterxml:jackson-dataformat-xml::::::::		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:fasterxml:jackson-dataformat-xml::::::::
cpe:2.3:a:fasterxml:jackson-dataformat-xml:2.8.0:-::::::		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:fasterxml:jackson-dataformat-xml:2.8.0:-::::::
cpe:2.3:a:fasterxml:jackson-dataformat-xml:2.8.0:rc1::::::		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:fasterxml:jackson-dataformat-xml:2.8.0:rc1::::::
cpe:2.3:a:fasterxml:jackson-dataformat-xml:2.8.0:rc2::::::		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:fasterxml:jackson-dataformat-xml:2.8.0:rc2::::::
cpe:2.3:a:fasterxml:jackson-dataformat-xml:2.8.1:::::::*		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:fasterxml:jackson-dataformat-xml:2.8.1:::::::*
cpe:2.3:a:fasterxml:jackson-dataformat-xml:2.8.2:::::::*		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:fasterxml:jackson-dataformat-xml:2.8.2:::::::*
cpe:2.3:a:fasterxml:jackson-dataformat-xml:2.8.3:::::::*		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:fasterxml:jackson-dataformat-xml:2.8.3:::::::*
CVE-2016-7051		https://nvd.nist.gov/vuln/detail/CVE-2016-7051
GHSA-7c2r-3jqf-c9rw		https://github.com/advisories/GHSA-7c2r-3jqf-c9rw

No exploits are available.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N Found at https://bugzilla.redhat.com/show_bug.cgi?id=1378673

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N Found at https://github.com/FasterXML/jackson-dataformat-xml

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N Found at https://github.com/FasterXML/jackson-dataformat-xml/issues/211

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2016-7051

Exploitability (E)	Access Vector (AV)	Access Complexity (AC)	Authentication (Au)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
high functional unproven proof_of_concept not_defined	local adjacent_network network	high medium low	multiple single none	none partial complete	none partial complete	none partial complete

Exploitability (E)

Access Vector (AV)

Access Complexity (AC)

Authentication (Au)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

partial

complete

none

partial

complete

none

partial

complete

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2016-7051

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2016-7051

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N Found at http://www.securityfocus.com/bid/97688

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Exploit Prediction Scoring System (EPSS)

Percentile	0.55597
EPSS Score	0.00181
Published At	Dec. 17, 2024, midnight

Date	Actor	Action	Source	VulnerableCode Version
There are no relevant records.