CVE-2019-12384

CVE-2019-12384 is a deserialization vulnerability in FasterXML jackson-databind 2.x before version 2.9.9.1, allowing attackers to bypass security controls by leveraging the logback-core class during polymorphic deserialization, potentially leading to remote code execution depending on the classpath. This vulnerability has a CVSS score of 5.9 (Medium) with a network attack vector and high impact on confidentiality, but requires high attack complexity. While there is no evidence of active exploitation or publicly available exploit code in Metasploit, Nuclei, or ExploitDB, the vulnerability has garnered some community discussion and media coverage, indicating awareness.