CVE-2020-14060

Published: Jun 14, 2020Modified: Apr 29, 2026

8.1

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.2 / Impact: 5.9

Source: NVD

Description

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool (aka apache/drill).

Affected (19)

Products: Fasterxml: Jackson Databind · Netapp: Active Iq Unified Manager, Steelstore Cloud Integrated Storage · Oracle: Agile Plm, Banking Digital Experience, Communications Calendar Server, Communications Contacts Server, Communications Diameter Signaling Router, Communications Element Manager, Communications Evolved Communications Application Server, Communications Session Report Manager, Communications Session Route Manager

Fasterxml

1 product

Jackson Databind

Netapp

2 products

Active Iq Unified Manager

Steelstore Cloud Integrated Storage

Oracle

9 products

Agile Plm

Banking Digital Experience

Communications Calendar Server

Communications Contacts Server

Communications Diameter Signaling Router

Communications Element Manager

Communications Evolved Communications Application Server

Communications Session Report Manager

Communications Session Route Manager

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Fasterxml Jackson Databind	From 2.0.0 to 2.9.10.5

Configuration B

4 vulnerable

Vulnerable Software	Affected Versions
Netapp Active Iq Unified Manager	From 7.3
Netapp Active Iq Unified Manager	From 9.5
Netapp Active Iq Unified Manager	From 7.3
Netapp Steelstore Cloud Integrated Storage	All versions

Configuration C

14 vulnerable

Vulnerable Software	Affected Versions
Oracle Agile Plm	Version 9.3.6
Oracle Banking Digital Experience	Version 18.1
Oracle Banking Digital Experience	Version 18.2
Oracle Banking Digital Experience	Version 18.3
Oracle Banking Digital Experience	Version 19.1
Oracle Banking Digital Experience	Version 19.2
Oracle Banking Digital Experience	Version 20.1
Oracle Communications Calendar Server	Version 8.0.0.4.0
Oracle Communications Contacts Server	Version 8.0.0.5.0
Oracle Communications Diameter Signaling Router	From 8.0.0 to 8.2.2
Oracle Communications Element Manager	From 8.2.0 to 8.2.2
Oracle Communications Evolved Communications Application Server	Version 7.1
Oracle Communications Session Report Manager	From 8.2.0 to 8.2.2
Oracle Communications Session Route Manager	From 8.2.0 to 8.2.2