CVE-2020-14062

—

CVSS 3.1

8.1 high

EPSS

8%p94

Published

Jun 14, 2020 (Jun 14, 2020)

Modified

Aug 25, 2026

Description

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool (aka xalan2).

Vendors: fasterxml netapp debian oracle
Products: jackson-databind, active iq unified manager, steelstore cloud integrated storage, debian linux, agile product lifecycle management, banking digital experience, communications calendar server, communications contacts server, communications diameter signaling router, communications element manager, communications evolved communications application server, communications session report manager
Weakness: CWE-502
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (8.1%)

In the news0 stories

No ingested article mentions this CVE yet.