CVE-2016-7051: Server-Side Request Forgery (SSRF)

October 18, 2018 (updated September 2, 2021)

XmlMapper in the Jackson XML dataformat component (aka jackson-dataformat-xml) before 2.7.8 and 2.8.x before 2.8.4 allows remote attackers to conduct server-side request forgery (SSRF) attacks via vectors related to a DTD.

References

www.securityfocus.com/bid/97688
bugzilla.redhat.com/show_bug.cgi?id=1378673
github.com/FasterXML/jackson-dataformat-xml/issues/211
github.com/advisories/GHSA-7c2r-3jqf-c9rw
nvd.nist.gov/vuln/detail/CVE-2016-7051

Code Behaviors & Features

Detect and mitigate CVE-2016-7051 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →