CVE-2020-14195

Published: Jun 16, 2020Modified: Nov 21, 2024

8.1

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.2 / Impact: 5.9

Source: NVD

Description

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity).

Affected (21)

Products: Fasterxml: Jackson Databind · Netapp: Active Iq Unified Manager, Steelstore Cloud Integrated Storage · Debian: Debian Linux · +1 more

Show all products

Fasterxml: Jackson Databind · Netapp: Active Iq Unified Manager, Steelstore Cloud Integrated Storage · Debian: Debian Linux · Oracle: Agile Plm, Banking Digital Experience, Communications Calendar Server, Communications Contacts Server, Communications Diameter Signaling Router, Communications Element Manager, Communications Evolved Communications Application Server, Communications Instant Messaging Server, Communications Session Report Manager, Communications Session Route Manager

Fasterxml

1 product

Jackson Databind

Netapp

2 products

Active Iq Unified Manager

Steelstore Cloud Integrated Storage

1 product

10 products

Banking Digital Experience

Communications Calendar Server

Communications Contacts Server

Communications Diameter Signaling Router

Communications Element Manager

Communications Evolved Communications Application Server

Communications Instant Messaging Server

Communications Session Report Manager

Communications Session Route Manager

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Fasterxml Jackson Databind	From 2.9.0 to 2.9.10.5

Configuration B

4 vulnerable

Vulnerable Software	Affected Versions
Netapp Active Iq Unified Manager	From 7.3
Netapp Active Iq Unified Manager	From 9.5
Netapp Active Iq Unified Manager	From 7.3
Netapp Steelstore Cloud Integrated Storage	All versions

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0

Configuration D

15 vulnerable

Vulnerable Software	Affected Versions
Oracle Agile Plm	Version 9.3.6
Oracle Banking Digital Experience	Version 18.1
Oracle Banking Digital Experience	Version 18.2
Oracle Banking Digital Experience	Version 18.3
Oracle Banking Digital Experience	Version 19.1
Oracle Banking Digital Experience	Version 19.2
Oracle Banking Digital Experience	Version 20.1
Oracle Communications Calendar Server	Version 8.0.0.4.0
Oracle Communications Contacts Server	Version 8.0.0.5.0
Oracle Communications Diameter Signaling Router	From 8.0.0 to 8.2.2
Oracle Communications Element Manager	From 8.2.0 to 8.2.2
Oracle Communications Evolved Communications Application Server	Version 7.1
Oracle Communications Instant Messaging Server	Version 10.0.1.4.0
Oracle Communications Session Report Manager	From 8.2.0 to 8.2.2
Oracle Communications Session Route Manager	From 8.2.0 to 8.2.2