CVE-2020-9547

—

CVSS 3.1

9.8 critical

EPSS

18%p97

Published

Mar 2, 2020 (Mar 2, 2020)

Modified

Jun 17, 2026

Description

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).

Vendors: fasterxml netapp debian oracle
Products: jackson-databind, active iq unified manager, debian linux, autovue for agile product lifecycle management, banking platform, communications contacts server, communications evolved communications application server, communications instant messaging server, communications network charging and control, enterprise manager base platform, global lifecycle management opatch, jd edwards enterpriseone orchestrator
Weakness: CWE-502
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (18.4%)

In the news0 stories

No ingested article mentions this CVE yet.