Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set.
    (CVE-2018-21234)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set.
    (CVE-2018-21234)

ID	Name	Product	Family	Severity
262885	Linux Distros Unpatched Vulnerability : CVE-2018-21234	Nessus	Misc.	critical
416562	SCA: security update for org.jodd:jodd-json (GHSA-jrg3-qq99-35g7)	Tenable Cloud Security	SCA Checks	critical
416562	SCA: security update for org.jodd:jodd-json (GHSA-jrg3-qq99-35g7)	Tenable Self-Hosted Container Security	SCA Checks	critical

Detections

Analytics

CVE-2018-21234

critical

Tenable Plugins

critical

critical

critical