Lucene search

[email protected]NVD:CVE-2020-24750

HistorySep 17, 2020 - 7:15 p.m.

CVE-2020-24750

2020-09-1719:15:13

CWE-502

[email protected]

web.nvd.nist.gov

fasterxml jackson-databind

serialization gadgets

typing

jndiconfiguration

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.007

Percentile

80.7%

JSON

FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.

Affected configurations

Nvd

Node

fasterxmljackson-databindRange2.0.0–2.6.7.5

fasterxmljackson-databindRange2.7.0–2.9.10.6

Node

oracleagile_plmMatch9.3.6

oracleapplication_testing_suiteMatch13.3.0.1

oracleautovue_for_agile_product_lifecycle_managementMatch21.0.2

oraclebanking_corporate_lending_process_managementMatch14.2.0

oraclebanking_corporate_lending_process_managementMatch14.3.0

oraclebanking_corporate_lending_process_managementMatch14.5.0

oraclebanking_credit_facilities_process_managementMatch14.2.0

oraclebanking_credit_facilities_process_managementMatch14.3.0

oraclebanking_credit_facilities_process_managementMatch14.5.0

oraclebanking_liquidity_managementMatch14.2

oraclebanking_liquidity_managementMatch14.3

oraclebanking_liquidity_managementMatch14.5

oraclebanking_supply_chain_financeMatch14.2.0

oraclebanking_supply_chain_financeMatch14.3.0

oraclebanking_supply_chain_financeMatch14.5.0

oracleblockchain_platformRange<21.1.2

oraclecommunications_calendar_serverMatch8.0

oraclecommunications_calendar_serverMatch8.0.0.4.0

oraclecommunications_contacts_serverMatch8.0

oraclecommunications_contacts_serverMatch8.0.0.5.0

oraclecommunications_diameter_signaling_routerRange8.0.0–8.2.2

oraclecommunications_element_managerRange8.2.0–8.2.4.0

oraclecommunications_instant_messaging_serverMatch10.0.1.5.0

oraclecommunications_messaging_serverMatch8.1

oraclecommunications_offline_mediation_controllerMatch12.0.0.3.0

oraclecommunications_policy_managementMatch12.5.0

oraclecommunications_pricing_design_centerMatch12.0.0.4.0

oraclecommunications_services_gatekeeperMatch7.0

oraclecommunications_session_report_managerRange8.0.0.0–8.2.2.1

oraclecommunications_session_route_managerRange8.2.0–8.2.2.1

oraclecommunications_unified_inventory_managementMatch7.4.1

oracleidentity_manager_connectorMatch11.1.1.5.0

oraclesiebel_core_-_server_frameworkRange≤21.5

oraclesiebel_ui_frameworkRange≤21.2

Node

debiandebian_linuxMatch9.0

VendorProductVersionCPE
fasterxmljackson-databind*cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
oracleagile_plm9.3.6cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*
oracleapplication_testing_suite13.3.0.1cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*
oracleautovue_for_agile_product_lifecycle_management21.0.2cpe:2.3:a:oracle:autovue_for_agile_product_lifecycle_management:21.0.2:*:*:*:*:*:*:*
oraclebanking_corporate_lending_process_management14.2.0cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2.0:*:*:*:*:*:*:*
oraclebanking_corporate_lending_process_management14.3.0cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3.0:*:*:*:*:*:*:*
oraclebanking_corporate_lending_process_management14.5.0cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5.0:*:*:*:*:*:*:*
oraclebanking_credit_facilities_process_management14.2.0cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2.0:*:*:*:*:*:*:*
oraclebanking_credit_facilities_process_management14.3.0cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3.0:*:*:*:*:*:*:*
oraclebanking_credit_facilities_process_management14.5.0cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
fasterxml	jackson-databind	*	cpe:2.3:a:fasterxml:jackson-databind::::::::
oracle	agile_plm	9.3.6	cpe:2.3:a:oracle:agile_plm:9.3.6:::::::*
oracle	application_testing_suite	13.3.0.1	cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:::::::*
oracle	autovue_for_agile_product_lifecycle_management	21.0.2	cpe:2.3:a:oracle:autovue_for_agile_product_lifecycle_management:21.0.2:::::::*
oracle	banking_corporate_lending_process_management	14.2.0	cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2.0:::::::*
oracle	banking_corporate_lending_process_management	14.3.0	cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3.0:::::::*
oracle	banking_corporate_lending_process_management	14.5.0	cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5.0:::::::*
oracle	banking_credit_facilities_process_management	14.2.0	cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2.0:::::::*
oracle	banking_credit_facilities_process_management	14.3.0	cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3.0:::::::*
oracle	banking_credit_facilities_process_management	14.5.0	cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5.0:::::::*