CVE-2020-35728

—

CVSS 3.1

8.1 high

EPSS

13%p96

Published

Dec 27, 2020 (Dec 27, 2020)

Modified

Aug 25, 2026

Description

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).

Vendors: fasterxml debian netapp oracle
Products: jackson-databind, debian linux, service level manager, agile product lifecycle management, application testing suite, autovue, banking corporate lending process management, banking credit facilities process management, banking extensibility workbench, banking supply chain finance, banking treasury management, banking virtual account management
Weakness: CWE-502
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (12.5%)

In the news0 stories

No ingested article mentions this CVE yet.