CVE-2020-11619

—

CVSS 3.1

8.1 high

EPSS

4%p89

Published

Apr 7, 2020 (Apr 7, 2020)

Modified

Aug 25, 2026

Description

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop).

Vendors: fasterxml debian netapp oracle
Products: jackson-databind, debian linux, active iq unified manager, steelstore cloud integrated storage, agile product lifecycle management, banking platform, communications calendar server, communications contacts server, communications diameter signaling router, communications evolved communications application server, communications instant messaging server, communications network charging and control
Weakness: CWE-502
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (3.7%)

In the news0 stories

No ingested article mentions this CVE yet.