CVEvulnerability

CVE-2020-9547

9.8 CRITICAL Published 2020-03-02 Modified 2026-10-07 Official page ↗
Status
Modified
Published
2020-03-02
Last modified
2026-10-07
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
CWE-502

Description

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).

Affected configurations

• fasterxml jackson-databind (>= 2.0.0 < 2.7.9.7) • fasterxml jackson-databind (>= 2.8.0 < 2.8.11.6) • fasterxml jackson-databind (>= 2.9.0 < 2.9.10.4) • netapp active iq unified manager (>= 7.3) • netapp active iq unified manager (>= 9.5) • debian debian linux 8.0 • oracle autovue for agile product lifecycle management 21.0.2 • oracle banking platform (>= 2.4.0 <= 2.9.0) • oracle communications contacts server 8.0.0.4.0 • oracle communications evolved communications application server 7.1 • oracle communications instant messaging server 10.0.1.4.0 • oracle communications network charging and control (>= 12.0.0 <= 12.0.3) • oracle communications network charging and control 6.0.1 • oracle enterprise manager base platform 13.3.0.0 • oracle enterprise manager base platform 13.4.0.0 • oracle global lifecycle management opatch (< 12.2.0.1.20) • oracle jd edwards enterpriseone orchestrator (< 9.2.4.2) • oracle jd edwards enterpriseone tools (< 9.2.4.2) • oracle primavera unifier (>= 17.7 <= 17.12) • oracle primavera unifier 16.1 • oracle primavera unifier 16.2 • oracle primavera unifier 18.8 • oracle primavera unifier 19.12 • oracle retail xstore point of service 15.0 • oracle retail xstore point of service 16.0 • oracle retail xstore point of service 17.0 • oracle retail xstore point of service 18.0 • oracle retail xstore point of service 19.0 • oracle weblogic server 12.2.1.3.0 • oracle weblogic server 12.2.1.4.0

Related

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References