CVE-2020-24616

—

CVSS 3.1

8.1 high

EPSS

9%p95

Published

Aug 25, 2020 (Aug 25, 2020)

Modified

Aug 25, 2026

Description

FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).

Vendors: fasterxml netapp oracle debian
Products: jackson-databind, active iq unified manager, agile product lifecycle management, application testing suite, autovue for agile product lifecycle management, banking liquidity management, banking supply chain finance, blockchain platform, communications calendar server, communications cloud native core unified data repository, communications contacts server, communications diameter signaling router
Weakness: CWE-502
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (9.4%)

In the news0 stories

No ingested article mentions this CVE yet.