Loading HuntDB...
Hunt
Vulnerability Intelligence by wss.sh
Home Daily Briefings High Impact CVEs Recent Exploits KEV Catalog GitHub Advisories Latest Updates Security News
Sign In Sign Up

CVE-2020-36181

HIGH
Published 2021-01-06T22:29:19
Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2020-36181. We'll provide specific mitigation strategies based on your environment and risk profile.

CVSS Score

V3.1
8.8
/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score Metrics
Exploitability: N/A Impact: N/A

EPSS Score

v2025.03.14
0.063
probability
of exploitation in the wild

There is a 6.3% chance that this vulnerability will be exploited in the wild within the next 30 days.

Updated: 2025-06-25
Exploit Probability
Percentile: 0.905
Higher than 90.5% of all CVEs

Attack Vector Metrics

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED

Impact Metrics

Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Description

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS.

Available Exploits

No exploits available for this CVE.

Related News

No news articles found for this CVE.

Affected Products

debian

debian_linux

Affected Versions:

8.0
netapp

steelstore_cloud_integrated_storage

Affected Versions:

*
oracle

agile_plm

Affected Versions:

9.3.6
oracle

autovue_for_agile_product_lifecycle_management

Affected Versions:

21.0.2
oracle

banking_digital_experience

Affected Versions:

18.1 19.1 20.1 2.4.0
oracle

communications_calendar_server

Affected Versions:

8.0.0.4.0
oracle

communications_diameter_signaling_router

Affected Versions:

8.0.0
oracle

communications_element_manager

Affected Versions:

8.2.0
oracle

communications_evolved_communications_application_server

Affected Versions:

7.1
oracle

communications_instant_messaging_server

Affected Versions:

10.0.1.4.0
oracle

communications_network_charging_and_control

Affected Versions:

6.0.1
oracle

communications_network_charging_and_control

Affected Versions:

12.0.0
oracle

communications_session_route_manager

Affected Versions:

8.2.0
oracle

enterprise_manager_base_platform

Affected Versions:

13.3.0.0
oracle

financial_services_analytical_applications_infrastructure

Affected Versions:

8.0.6
oracle

financial_services_institutional_performance_analytics

Affected Versions:

8.0.6 8.0.7 8.1.0
oracle

financial_services_price_creation_and_discovery

Affected Versions:

8.0.6
oracle

financial_services_retail_customer_analytics

Affected Versions:

8.0.6
oracle

global_lifecycle_management_opatch

Affected Versions:

0
oracle

insurance_policy_administration_j2ee

Affected Versions:

11.0.2.25
oracle

jd_edwards_enterpriseone_orchestrator

Affected Versions:

0
oracle

primavera_unifier

Affected Versions:

16.1 16.2 17.7 18.8 19.12
oracle

retail_merchandising_system

Affected Versions:

15.0
oracle

retail_sales_audit

Affected Versions:

14.1
oracle

retail_service_backbone

Affected Versions:

14.1 15.0 16.0
oracle

retail_xstore_point_of_service

Affected Versions:

15.0
oracle

weblogic_server

Affected Versions:

12.2.1.3.0
fasterxml

jackson-databind

Affected Versions:

2.0.0

GitHub Security Advisories

Community-driven vulnerability intelligence from GitHub

✓ GitHub Reviewed HIGH

Unsafe Deserialization in jackson-databind

GHSA-cvm9-fjm9-3572

Advisory Details

FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related to `org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS`.

Affected Packages

Maven com.fasterxml.jackson.core:jackson-databind
ECOSYSTEM: ≥2.7.0 <2.9.10.8
Maven com.fasterxml.jackson.core:jackson-databind
ECOSYSTEM: ≥2.0.0 <2.6.7.5

CVSS Scoring

CVSS Score

7.5

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2020-36181
WEB https://github.com/FasterXML/jackson-databind/issues/3004
WEB https://github.com/FasterXML/jackson-databind/commit/3ded28aece694d0df39c9f0fa1ff385b14a8656b
WEB https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
PACKAGE https://github.com/FasterXML/jackson-databind
WEB https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html
WEB https://security.netapp.com/advisory/ntap-20210205-0005
WEB https://www.oracle.com//security-alerts/cpujul2021.html
WEB https://www.oracle.com/security-alerts/cpuApr2021.html
WEB https://www.oracle.com/security-alerts/cpuapr2022.html
WEB https://www.oracle.com/security-alerts/cpujan2022.html
WEB https://www.oracle.com/security-alerts/cpujul2022.html
WEB https://www.oracle.com/security-alerts/cpuoct2021.html

Advisory provided by GitHub Security Advisory Database. Published: December 9, 2021, Modified: September 14, 2023

References

https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
https://github.com/FasterXML/jackson-databind/issues/3004
https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://security.netapp.com/advisory/ntap-20210205-0005/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
https://www.oracle.com/security-alerts/cpujan2022.html
https://www.oracle.com/security-alerts/cpuapr2022.html
https://www.oracle.com/security-alerts/cpujul2022.html
Published: 2021-01-06T22:29:19
Last Modified: 2024-08-04T17:23:09.306Z
Copied to clipboard!