CVE-2020-14195

—

CVSS 3.1

8.1 high

EPSS

5%p91

Published

Jun 16, 2020 (Jun 16, 2020)

Modified

Aug 25, 2026

Description

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity).

Vendors: fasterxml netapp debian oracle
Products: jackson-databind, active iq unified manager, steelstore cloud integrated storage, debian linux, agile product lifecycle management, banking digital experience, communications calendar server, communications contacts server, communications diameter signaling router, communications element manager, communications evolved communications application server, communications instant messaging server
Weakness: CWE-502
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (4.5%)

In the news0 stories

No ingested article mentions this CVE yet.