CVE-2020-35490

Published: Dec 17, 2020Modified: Jun 17, 2026

8.1

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.2 / Impact: 5.9

Source: NVD

Description

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource.

Affected (38)

Products: Fasterxml: Jackson Databind · Netapp: Service Level Manager · Debian: Debian Linux · +1 more

Show all products

Fasterxml: Jackson Databind · Netapp: Service Level Manager · Debian: Debian Linux · Oracle: Agile Plm, Application Testing Suite, Autovue For Agile Product Lifecycle Management, Banking Platform, Banking Treasury Management, Banking Virtual Account Management, Blockchain Platform, Communications Cloud Native Core Policy, Communications Cloud Native Core Unified Data Repository, Communications Diameter Signaling Router, Communications Evolved Communications Application Server, Communications Instant Messaging Server, Communications Interactive Session Recorder, Communications Offline Mediation Controller, Communications Pricing Design Center, Communications Services Gatekeeper, Communications Unified Inventory Management, Documaker, Insurance Policy Administration J2ee, Retail Merchandising System, Retail Xstore Point Of Service, Webcenter Portal

Fasterxml

1 product

Jackson Databind

Netapp

1 product

Service Level Manager

1 product

22 products

Application Testing Suite

Autovue For Agile Product Lifecycle Management

Banking Platform

Banking Treasury Management

Banking Virtual Account Management

Blockchain Platform

Communications Cloud Native Core Policy

Communications Cloud Native Core Unified Data Repository

Communications Diameter Signaling Router

Communications Evolved Communications Application Server

Communications Instant Messaging Server

Communications Interactive Session Recorder

Communications Offline Mediation Controller

Communications Pricing Design Center

Communications Services Gatekeeper

Communications Unified Inventory Management

Documaker

Insurance Policy Administration J2ee

Retail Merchandising System

Retail Xstore Point Of Service

Webcenter Portal

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Fasterxml Jackson Databind	From 2.0.0 to 2.9.10.8

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Netapp Service Level Manager	All versions

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 9.0

Configuration D

35 vulnerable

Vulnerable Software	Affected Versions
Oracle Agile Plm	Version 9.3.6
Oracle Application Testing Suite	Version 13.3.0.1
Oracle Autovue For Agile Product Lifecycle Management	Version 21.0.2
Oracle Banking Platform	Version 2.10.0
Oracle Banking Platform	Version 2.6.2
Oracle Banking Platform	Version 2.7.0
Oracle Banking Platform	Version 2.7.1
Oracle Banking Platform	Version 2.8.0
Oracle Banking Platform	Version 2.9.0
Oracle Banking Treasury Management	Version 14.4
Oracle Banking Virtual Account Management	Version 14.2.0
Oracle Banking Virtual Account Management	Version 14.3.0
Oracle Banking Virtual Account Management	Version 14.5.0
Oracle Blockchain Platform	Up to 21.1.2
Oracle Communications Cloud Native Core Policy	Version 1.14.0
Oracle Communications Cloud Native Core Unified Data Repository	Version 1.4.0
Oracle Communications Diameter Signaling Router	From 8.0.0 to 8.5.0
Oracle Communications Evolved Communications Application Server	Version 7.1
Oracle Communications Instant Messaging Server	Version 10.0.1.5.0
Oracle Communications Interactive Session Recorder	Version 6.3
Oracle Communications Interactive Session Recorder	Version 6.4
Oracle Communications Offline Mediation Controller	Version 12.0.0.3
Oracle Communications Pricing Design Center	Version 12.0.0.4.0
Oracle Communications Services Gatekeeper	Version 7.0
Oracle Communications Unified Inventory Management	Version 7.4.1
Oracle Documaker	Version 12.6.3
Oracle Documaker	Version 12.6.4
Oracle Insurance Policy Administration J2ee	Version 11.2.0
Oracle Retail Merchandising System	Version 15.0.3
Oracle Retail Xstore Point Of Service	Version 16.0.6
Oracle Retail Xstore Point Of Service	Version 17.0.4
Oracle Retail Xstore Point Of Service	Version 18.0.3
Oracle Retail Xstore Point Of Service	Version 19.0.2
Oracle Webcenter Portal	Version 12.2.1.3.0
Oracle Webcenter Portal	Version 12.2.1.4.0