CVE-2020-8840 | SynScan

Vulnerability Database

289,599

Total vulnerabilities in the database

CVE-2020-8840

FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.

Published: Feb 10, 2020
Updated: Jun 9, 2023
CVE: CVE-2020-8840
GHSA: GHSA-4w82-r329-3q67
Severity: Critical
Exploit:

CVSS v3:

Severity: Critical
Score: 9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2:

Severity: High
Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P

CWEs:

CWE-502

OWASP TOP 10:

A8 - Insecure Deserialization

Affected Software
References

Software	From	Fixed in
fasterxml / jackson-databind	2.8.0	2.8.11.5
fasterxml / jackson-databind	2.9.0	2.9.10.3
debian / debian_linux	8.0	8.0.x
huawei / oceanstor_9000_firmware	300r006c20	300r006c20.x
huawei / oceanstor_9000_firmware	300r006c20spc100	300r006c20spc100.x
huawei / oceanstor_9000_firmware	300r006c20spc200	300r006c20spc200.x
huawei / oceanstor_9000_firmware	300r006c20spc300	300r006c20spc300.x
oracle / global_lifecycle_management_opatch	-	11.2.0.3.23
oracle / global_lifecycle_management_opatch	12.2.0.1.0	12.2.0.1.19
oracle / global_lifecycle_management_opatch	13.9.4.0.0	13.9.4.2.1
com.fasterxml.jackson.core / jackson-databind	2.0.0	2.6.7.4
com.fasterxml.jackson.core / jackson-databind	2.7.0	2.7.9.7
com.fasterxml.jackson.core / jackson-databind	2.8.0	2.8.11.5
com.fasterxml.jackson.core / jackson-databind	2.9.0	2.9.10.3
fasterxml / jackson-databind	2.0.0	2.7.9.7