Lucene search

[email protected]NVD:CVE-2020-14195

HistoryJun 16, 2020 - 4:15 p.m.

CVE-2020-14195

2020-06-1616:15:11

CWE-502

[email protected]

web.nvd.nist.gov

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.034

Percentile

91.5%

JSON

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity).

Affected configurations

Nvd

Node

fasterxmljackson-databindRange2.9.0–2.9.10.5

Node

netappactive_iq_unified_managerRange7.3≥linux

netappactive_iq_unified_managerRange7.3≥windows

netappactive_iq_unified_managerRange9.5≥vmware_vsphere

netappsteelstore_cloud_integrated_storageMatch-

Node

debiandebian_linuxMatch8.0

Node

oracleagile_plmMatch9.3.6

oraclebanking_digital_experienceMatch18.1

oraclebanking_digital_experienceMatch18.2

oraclebanking_digital_experienceMatch18.3

oraclebanking_digital_experienceMatch19.1

oraclebanking_digital_experienceMatch19.2

oraclebanking_digital_experienceMatch20.1

oraclecommunications_calendar_serverMatch8.0.0.4.0

oraclecommunications_contacts_serverMatch8.0.0.5.0

oraclecommunications_diameter_signaling_routerRange8.0.0–8.2.2

oraclecommunications_element_managerRange8.2.0–8.2.2

oraclecommunications_evolved_communications_application_serverMatch7.1

oraclecommunications_instant_messaging_serverMatch10.0.1.4.0

oraclecommunications_session_report_managerRange8.2.0–8.2.2

oraclecommunications_session_route_managerRange8.2.0–8.2.2

VendorProductVersionCPE
fasterxmljackson-databind*cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
netappactive_iq_unified_manager*cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:linux:*:*
netappactive_iq_unified_manager*cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:*
netappactive_iq_unified_manager*cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:*
netappsteelstore_cloud_integrated_storage-cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*
debiandebian_linux8.0cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
oracleagile_plm9.3.6cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*
oraclebanking_digital_experience18.1cpe:2.3:a:oracle:banking_digital_experience:18.1:*:*:*:*:*:*:*
oraclebanking_digital_experience18.2cpe:2.3:a:oracle:banking_digital_experience:18.2:*:*:*:*:*:*:*
oraclebanking_digital_experience18.3cpe:2.3:a:oracle:banking_digital_experience:18.3:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
fasterxml	jackson-databind	*	cpe:2.3:a:fasterxml:jackson-databind::::::::
netapp	active_iq_unified_manager	*	cpe:2.3:a:netapp:active_iq_unified_manager::::::linux::*
netapp	active_iq_unified_manager	*	cpe:2.3:a:netapp:active_iq_unified_manager::::::windows::*
netapp	active_iq_unified_manager	*	cpe:2.3:a:netapp:active_iq_unified_manager::::::vmware_vsphere::*
netapp	steelstore_cloud_integrated_storage	-	cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:::::::*
debian	debian_linux	8.0	cpe:2.3:o:debian:debian_linux:8.0:::::::*
oracle	agile_plm	9.3.6	cpe:2.3:a:oracle:agile_plm:9.3.6:::::::*
oracle	banking_digital_experience	18.1	cpe:2.3:a:oracle:banking_digital_experience:18.1:::::::*
oracle	banking_digital_experience	18.2	cpe:2.3:a:oracle:banking_digital_experience:18.2:::::::*
oracle	banking_digital_experience	18.3	cpe:2.3:a:oracle:banking_digital_experience:18.3:::::::*