CVE-2020-11620

—

CVSS 3.1

8.1 high

EPSS

6%p93

Published

Apr 7, 2020 (Apr 7, 2020)

Modified

Jun 17, 2026

Description

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka commons-jelly).

Vendors: fasterxml debian netapp oracle
Products: jackson-databind, debian linux, active iq unified manager, steelstore cloud integrated storage, banking platform, communications contacts server, communications evolved communications application server, communications instant messaging server, communications network charging and control, enterprise manager base platform, global lifecycle management opatch, jd edwards enterpriseone orchestrator
Weakness: CWE-502
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (5.8%)

In the news0 stories

No ingested article mentions this CVE yet.