| Package | Affected versions | Patched versions |
|---|---|---|
| com.fasterxml.jackson.core:jackson-databind | ≥ 2.21.0, < 2.21.4≥ 3.0.0, < 3.1.4 | 2.21.43.1.4 |
| tools.jackson.core:jackson-databind | ≥ 3.0.0, < 3.1.4 | 3.1.4 |
| jackson-databind | ≥ 2.21.0, < 2.21.4≥ 3.0.0, < 3.1.4 | 2.21.43.1.4 |
In BeanDeserializer._deserializeUsingPropertyBased, the active-view (@JsonView) filter was applied only to creator properties; the regular property-buffering branch performed no prop.visibleInView(activeView) check. A change making SetterlessProperty.isMerging() return true routed setterless Collection/Map properties through this unguarded path, so a setterless collection annotated with a restricted @JsonView is populated from attacker JSON even when the active view excludes it.
View-restricted (e.g. admin-only) setterless collection/map properties can be written from untrusted JSON despite @JsonView gating — an access-control / mass-assignment bypass. No RCE or DoS.
git tag --contains)>= 2.21.0, < 2.21.4 -> fixed in 2.21.4 (backport 94c5d21, #5970)>= 3.0.0, < 3.1.4 -> fixed in 3.1.4 (#5969, 5bf23ed)Maintainer: minor. Reporter: HIGH. CWE-863 (Incorrect Authorization); related CWE-1220.
Omkhar Arasaratnam (@omkhar) - finder.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free