Back to feed
EUVD-2020-0384 · Published Apr 23, 2020
jackson-databind mishandles the interaction between serialization gadgets and typing FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka commons-jelly).
Technologies
Fasterxml Jackson-DatabindOracle Enterprise Manager Base PlatformOracle Jd Edwards Enterpriseone OrchestratorOracle Communications Evolved Communications Application ServerOracle Banking PlatformOracle Communications Contacts ServerOracle Global Lifecycle Management OpatchOracle Retail Sales AuditOracle Retail Merchandising SystemNetapp Steelstore Cloud Integrated StorageOracle Primavera UnifierDebian Debian LinuxOracle Weblogic ServerOracle Jd Edwards Enterpriseone ToolsOracle Communications Network Charging And ControlOracle Retail Xstore Point Of ServiceOracle Communications Instant Messaging ServerNetapp Active Iq Unified Manager
Weaknesses
CWE-502
CVSS scores
- v3.18.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
MITRE ATT&CK
InferredWhere this vulnerability fits in an attack
Initial Access
References
- https://github.com/FasterXML/jackson-databind/issues/2682
- https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2020/04/msg00012.html
- https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
- https://security.netapp.com/advisory/ntap-20200511-0004/
- https://www.oracle.com/security-alerts/cpujan2021.html
Potentially impacted assets
See if this affects your attack surface
