CVE-2020-10672

EPSS 40.07%
Published 18.03.2020 22:15:12
Last modified 21.11.2024 04:55:49
Source cve@mitre.org
Teams watchlist Login
Open Login

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jms).

Affected products Warnungen 0 Metrics 4 CWE 1 References 11

Data is provided by the National Vulnerability Database (NVD)

Fasterxml ≫ Jackson-databind Version >= 2.9.0 < 2.9.10.4

Debian ≫ Debian Linux Version8.0

Netapp ≫ Steelstore Cloud Integrated Storage Version-

Oracle ≫ Agile Plm Version9.3.6

Oracle ≫ Autovue For Agile Product Lifecycle Management Version21.0.2

Oracle ≫ Banking Digital Experience Version18.1

Oracle ≫ Banking Digital Experience Version18.2

Oracle ≫ Banking Digital Experience Version18.3

Oracle ≫ Banking Digital Experience Version19.1

Oracle ≫ Banking Digital Experience Version19.2

Oracle ≫ Banking Digital Experience Version20.1

Oracle ≫ Banking Platform Version >= 2.4.0 <= 2.9.0

Oracle ≫ Communications Calendar Server Version8.0.0.4.0

Oracle ≫ Communications Contacts Server Version8.0.0.4.0

Oracle ≫ Communications Contacts Server Version8.0.0.5.0

Oracle ≫ Communications Diameter Signaling Router Version >= 8.0.0 <= 8.2.2

Oracle ≫ Communications Element Manager Version >= 8.2.0 <= 8.2.2

Oracle ≫ Communications Evolved Communications Application Server Version7.1

Oracle ≫ Communications Instant Messaging Server Version10.0.1.4.0

Oracle ≫ Communications Network Charging And Control Version >= 12.0.0 <= 12.0.3

Oracle ≫ Communications Network Charging And Control Version6.0.1

Oracle ≫ Communications Session Report Manager Version >= 8.2.0 <= 8.2.2

Oracle ≫ Communications Session Route Manager Version >= 8.2.0 <= 8.2.2

Oracle ≫ Enterprise Manager Base Platform Version13.3.0.0

Oracle ≫ Enterprise Manager Base Platform Version13.4.0.0

Oracle ≫ Financial Services Analytical Applications Infrastructure Version >= 8.0.6 <= 8.1.0

Oracle ≫ Financial Services Institutional Performance Analytics Version8.0.6

Oracle ≫ Financial Services Institutional Performance Analytics Version8.0.7

Oracle ≫ Financial Services Institutional Performance Analytics Version8.1.0

Oracle ≫ Financial Services Price Creation And Discovery Version8.0.6

Oracle ≫ Financial Services Price Creation And Discovery Version8.0.7

Oracle ≫ Financial Services Retail Customer Analytics Version8.0.6

Oracle ≫ Global Lifecycle Management Opatch Version < 12.2.0.1.20

Oracle ≫ Insurance Policy Administration J2ee Version11.0.2.25

Oracle ≫ Insurance Policy Administration J2ee Version11.1.0.15

Oracle ≫ Jd Edwards Enterpriseone Orchestrator Version < 9.2.4.2

Oracle ≫ Jd Edwards Enterpriseone Tools Version < 9.2.4.2

Oracle ≫ Primavera Unifier Version >= 17.7 <= 17.12

Oracle ≫ Primavera Unifier Version16.1

Oracle ≫ Primavera Unifier Version16.2

Oracle ≫ Primavera Unifier Version18.8

Oracle ≫ Primavera Unifier Version19.12

Oracle ≫ Retail Merchandising System Version15.0

Oracle ≫ Retail Sales Audit Version14.1

Oracle ≫ Retail Service Backbone Version14.1

Oracle ≫ Retail Service Backbone Version15.0

Oracle ≫ Retail Service Backbone Version16.0

Oracle ≫ Retail Xstore Point Of Service Version15.0

Oracle ≫ Retail Xstore Point Of Service Version16.0

Oracle ≫ Retail Xstore Point Of Service Version17.0

Oracle ≫ Retail Xstore Point Of Service Version18.0

Oracle ≫ Retail Xstore Point Of Service Version19.0

Oracle ≫ Weblogic Server Version12.2.1.3.0

Oracle ≫ Weblogic Server Version12.2.1.4.0

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	40.07%	0.97

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	8.8	2.8	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvd@nist.gov	6.8	8.6	6.4	AV:N/AC:M/Au:N/C:P/I:P/A:P
134c704f-9b21-4f2e-91b3-4a467353bcc0	8.8	2.8	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H