← Back

CVE-2020-11113

nvd nist
Published: Mar 31, 2020Modified: Jun 17, 2026

JSON object

Loading...
8.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: NVD

Description

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).

Affected (55)

Show all products
Fasterxml: Jackson Databind · Debian: Debian Linux · Netapp: Steelstore Cloud Integrated Storage · Oracle: Agile Plm, Autovue For Agile Product Lifecycle Management, Banking Digital Experience, Banking Platform, Communications Calendar Server, Communications Contacts Server, Communications Diameter Signaling Router, Communications Element Manager, Communications Evolved Communications Application Server, Communications Instant Messaging Server, Communications Network Charging And Control, Communications Session Report Manager, Communications Session Route Manager, Enterprise Manager Base Platform, Financial Services Analytical Applications Infrastructure, Financial Services Institutional Performance Analytics, Financial Services Price Creation And Discovery, Financial Services Retail Customer Analytics, Global Lifecycle Management Opatch, Insurance Policy Administration J2ee, Jd Edwards Enterpriseone Orchestrator, Jd Edwards Enterpriseone Tools, Primavera Unifier, Retail Merchandising System, Retail Sales Audit, Retail Service Backbone, Retail Xstore Point Of Service, Webcenter Portal, Weblogic Server
Fasterxml
1 product
Jackson Databind
Debian
1 product
Debian Linux
Netapp
1 product
Steelstore Cloud Integrated Storage
Oracle
29 products
Agile Plm
Autovue For Agile Product Lifecycle Management
Banking Digital Experience
Banking Platform
Communications Calendar Server
Communications Contacts Server
Communications Diameter Signaling Router
Communications Element Manager
Communications Evolved Communications Application Server
Communications Instant Messaging Server
Communications Network Charging And Control
Communications Session Report Manager
Communications Session Route Manager
Enterprise Manager Base Platform
Financial Services Analytical Applications Infrastructure
Financial Services Institutional Performance Analytics
Financial Services Price Creation And Discovery
Financial Services Retail Customer Analytics
Global Lifecycle Management Opatch
Insurance Policy Administration J2ee
Jd Edwards Enterpriseone Orchestrator
Jd Edwards Enterpriseone Tools
Primavera Unifier
Retail Merchandising System
Retail Sales Audit
Retail Service Backbone
Retail Xstore Point Of Service
Webcenter Portal
Weblogic Server
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Jackson Databind
From 2.0.0 to 2.9.10.4
Configuration B
1 vulnerable
Vulnerable SoftwareAffected Versions
Debian Linux
Version 8.0
Configuration C
1 vulnerable
Vulnerable SoftwareAffected Versions
Steelstore Cloud Integrated Storage
All versions
Configuration D
52 vulnerable
Vulnerable SoftwareAffected Versions
Agile Plm
Version 9.3.6
Autovue For Agile Product Lifecycle Management
Version 21.0.2
Oracle
Banking Digital Experience
Version 18.1
Banking Digital Experience
Version 18.2
Banking Digital Experience
Version 18.3
Banking Digital Experience
Version 19.1
Banking Digital Experience
Version 19.2
Banking Digital Experience
Version 20.1
Banking Platform
From 2.4.0 to 2.9.0
Communications Calendar Server
Version 8.0.0.4.0
Communications Contacts Server
Version 8.0.0.5.0
Communications Diameter Signaling Router
From 8.0.0 to 8.2.2
Communications Element Manager
From 8.2.0 to 8.2.2
Communications Evolved Communications Application Server
Version 7.1
Communications Instant Messaging Server
Version 10.0.1.4.0
Oracle
Communications Network Charging And Control
From 12.0.0 to 12.0.3
Communications Network Charging And Control
Version 6.0.1
Communications Session Report Manager
From 8.2.0 to 8.2.2
Communications Session Route Manager
From 8.2.0 to 8.2.2
Oracle
Enterprise Manager Base Platform
Version 13.3.0.0
Enterprise Manager Base Platform
Version 13.4.0.0
Financial Services Analytical Applications Infrastructure
From 8.0.6 to 8.1.0
Oracle
Financial Services Institutional Performance Analytics
Version 8.0.6
Financial Services Institutional Performance Analytics
Version 8.0.7
Financial Services Institutional Performance Analytics
Version 8.1.0
Oracle
Financial Services Price Creation And Discovery
Version 8.0.6
Financial Services Price Creation And Discovery
Version 8.0.7
Financial Services Retail Customer Analytics
Version 8.0.6
Global Lifecycle Management Opatch
Before 12.2.0.1.20
Oracle
Insurance Policy Administration J2ee
Version 11.0.2.25
Insurance Policy Administration J2ee
Version 11.1.0.15
Jd Edwards Enterpriseone Orchestrator
Before 9.2.4.2
Jd Edwards Enterpriseone Tools
Before 9.2.4.2
Oracle
Primavera Unifier
From 17.7 to 17.12
Primavera Unifier
Version 16.1
Primavera Unifier
Version 16.2
Primavera Unifier
Version 18.8
Primavera Unifier
Version 19.12
Retail Merchandising System
Version 15.0
Retail Sales Audit
Version 14.1
Oracle
Retail Service Backbone
Version 14.1
Retail Service Backbone
Version 15.0
Retail Service Backbone
Version 16.0
Oracle
Retail Xstore Point Of Service
Version 15.0
Retail Xstore Point Of Service
Version 16.0
Retail Xstore Point Of Service
Version 17.0
Retail Xstore Point Of Service
Version 18.0
Retail Xstore Point Of Service
Version 19.0
Oracle
Webcenter Portal
Version 12.2.1.3.0
Webcenter Portal
Version 12.2.1.4.0
Oracle
Weblogic Server
Version 12.2.1.3.0
Weblogic Server
Version 12.2.1.4.0

Related CWEs

CWE-502
Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (16)

Source: cve@mitre.org
PatchThird Party Advisory
Source: cve@mitre.org
Mailing ListThird Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
PatchThird Party Advisory
Source: cve@mitre.org
PatchThird Party Advisory
Source: cve@mitre.org
PatchThird Party Advisory
Source: cve@mitre.org
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory

Timeline

No history available yet.