Loading HuntDB...
Hunt
Vulnerability Intelligence by wss.sh
Home Daily Briefings High Impact CVEs Recent Exploits KEV Catalog GitHub Advisories Latest Updates Security News
Sign In Sign Up

CVE-2020-10672

HIGH
Published 2020-03-18T21:17:43
Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2020-10672. We'll provide specific mitigation strategies based on your environment and risk profile.

CVSS Score

V3.1
8.8
/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score Metrics
Exploitability: N/A Impact: N/A

EPSS Score

v2025.03.14
0.401
probability
of exploitation in the wild

There is a 40.1% chance that this vulnerability will be exploited in the wild within the next 30 days.

Updated: 2025-06-25
Exploit Probability
Percentile: 0.972
Higher than 97.2% of all CVEs

Attack Vector Metrics

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED

Impact Metrics

Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Description

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jms).

Available Exploits

No exploits available for this CVE.

Related News

No news articles found for this CVE.

Affected Products

debian

debian_linux

Affected Versions:

8.0
netapp

steelstore_cloud_integrated_storage

Affected Versions:

*
oracle

agile_plm

Affected Versions:

9.3.6
oracle

autovue_for_agile_product_lifecycle_management

Affected Versions:

21.0.2
oracle

banking_digital_experience

Affected Versions:

18.1 19.1 20.1 2.4.0
oracle

communications_calendar_server

Affected Versions:

8.0.0.4.0
oracle

communications_diameter_signaling_router

Affected Versions:

8.0.0
oracle

communications_element_manager

Affected Versions:

8.2.0
oracle

communications_evolved_communications_application_server

Affected Versions:

7.1
oracle

communications_instant_messaging_server

Affected Versions:

10.0.1.4.0
oracle

communications_network_charging_and_control

Affected Versions:

6.0.1
oracle

communications_network_charging_and_control

Affected Versions:

12.0.0
oracle

communications_session_route_manager

Affected Versions:

8.2.0
oracle

enterprise_manager_base_platform

Affected Versions:

13.3.0.0
oracle

financial_services_analytical_applications_infrastructure

Affected Versions:

8.0.6
oracle

financial_services_institutional_performance_analytics

Affected Versions:

8.0.6 8.0.7 8.1.0
oracle

financial_services_price_creation_and_discovery

Affected Versions:

8.0.6
oracle

financial_services_retail_customer_analytics

Affected Versions:

8.0.6
oracle

global_lifecycle_management_opatch

Affected Versions:

0
oracle

insurance_policy_administration_j2ee

Affected Versions:

11.0.2.25
oracle

jd_edwards_enterpriseone_orchestrator

Affected Versions:

0
oracle

primavera_unifier

Affected Versions:

16.1 16.2 17.7 18.8 19.12
oracle

retail_merchandising_system

Affected Versions:

15.0
oracle

retail_sales_audit

Affected Versions:

14.1
oracle

retail_service_backbone

Affected Versions:

14.1 15.0 16.0
oracle

retail_xstore_point_of_service

Affected Versions:

15.0
oracle

weblogic_server

Affected Versions:

12.2.1.3.0
fasterxml

jackson-databind

Affected Versions:

2.0.0

GitHub Security Advisories

Community-driven vulnerability intelligence from GitHub

✓ GitHub Reviewed HIGH

jackson-databind mishandles the interaction between serialization gadgets and typing

GHSA-95cm-88f5-f2c7

Advisory Details

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jms).

Affected Packages

Maven com.fasterxml.jackson.core:jackson-databind
ECOSYSTEM: ≥2.9.0 <2.9.10.4

CVSS Scoring

CVSS Score

7.5

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2020-10672
WEB https://github.com/FasterXML/jackson-databind/issues/2659
WEB https://github.com/FasterXML/jackson-databind/commit/08fbfacf89a4a4c026a6227a1b470ab7a13e2e88
WEB https://github.com/FasterXML/jackson-databind/commit/592872f4235c7f2a3280725278da55544032f72d
PACKAGE https://github.com/FasterXML/jackson-databind
WEB https://lists.debian.org/debian-lts-announce/2020/03/msg00027.html
WEB https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
WEB https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
WEB https://security.netapp.com/advisory/ntap-20200403-0002
WEB https://www.oracle.com/security-alerts/cpujan2021.html
WEB https://www.oracle.com/security-alerts/cpujul2020.html
WEB https://www.oracle.com/security-alerts/cpuoct2020.html
WEB https://www.oracle.com/security-alerts/cpuoct2021.html

Advisory provided by GitHub Security Advisory Database. Published: April 23, 2020, Modified: July 3, 2024

References

https://lists.debian.org/debian-lts-announce/2020/03/msg00027.html
https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
https://www.oracle.com/security-alerts/cpujul2020.html
https://github.com/FasterXML/jackson-databind/issues/2659
https://security.netapp.com/advisory/ntap-20200403-0002/
https://www.oracle.com/security-alerts/cpuoct2020.html
https://www.oracle.com/security-alerts/cpujan2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
Published: 2020-03-18T21:17:43
Last Modified: 2024-08-04T11:06:11.143Z
Copied to clipboard!