← Back

CVE-2020-35728

nvd nist
Published: Dec 27, 2020Modified: Jun 17, 2026

JSON object

Loading...
8.1
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.2 / Impact: 5.9
Source: NVD

Description

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).

Affected (66)

Show all products
Fasterxml: Jackson Databind · Debian: Debian Linux · Netapp: Service Level Manager · Oracle: Agile Plm, Application Testing Suite, Autovue, Banking Corporate Lending Process Management, Banking Credit Facilities Process Management, Banking Extensibility Workbench, Banking Supply Chain Finance, Banking Treasury Management, Banking Virtual Account Management, Blockchain Platform, Commerce Platform, Communications Billing And Revenue Management, Communications Cloud Native Core Policy, Communications Cloud Native Core Unified Data Repository, Communications Convergent Charging Controller, Communications Diameter Signaling Route, Communications Element Manager, Communications Evolved Communications Application Server, Communications Network Charging And Control, Communications Policy Management, Communications Services Gatekeeper, Communications Session Report Manager, Communications Session Route Manager, Communications Unified Inventory Management, Data Integrator, Goldengate Application Adapters, Insurance Policy Administration, Insurance Rules Palette, Jd Edwards Enterpriseone Orchestrator, Jd Edwards Enterpriseone Tools, Primavera Gateway, Primavera Unifier, Retail Customer Management And Segmentation Foundation, Retail Merchandising System, Retail Service Backbone, Retail Xstore Point Of Service, Webcenter Portal
Fasterxml
1 product
Jackson Databind
Debian
1 product
Debian Linux
Netapp
1 product
Service Level Manager
Oracle
37 products
Agile Plm
Application Testing Suite
Autovue
Banking Corporate Lending Process Management
Banking Credit Facilities Process Management
Banking Extensibility Workbench
Banking Supply Chain Finance
Banking Treasury Management
Banking Virtual Account Management
Blockchain Platform
Commerce Platform
Communications Billing And Revenue Management
Communications Cloud Native Core Policy
Communications Cloud Native Core Unified Data Repository
Communications Convergent Charging Controller
Communications Diameter Signaling Route
Communications Element Manager
Communications Evolved Communications Application Server
Communications Network Charging And Control
Communications Policy Management
Communications Services Gatekeeper
Communications Session Report Manager
Communications Session Route Manager
Communications Unified Inventory Management
Data Integrator
Goldengate Application Adapters
Insurance Policy Administration
Insurance Rules Palette
Jd Edwards Enterpriseone Orchestrator
Jd Edwards Enterpriseone Tools
Primavera Gateway
Primavera Unifier
Retail Customer Management And Segmentation Foundation
Retail Merchandising System
Retail Service Backbone
Retail Xstore Point Of Service
Webcenter Portal
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Fasterxml
Jackson Databind
From 2.0.0 to 2.6.7.5
Jackson Databind
From 2.7.0 to 2.9.10.8
Configuration B
1 vulnerable
Vulnerable SoftwareAffected Versions
Debian Linux
Version 9.0
Configuration C
1 vulnerable
Vulnerable SoftwareAffected Versions
Service Level Manager
All versions
Configuration D
62 vulnerable
Vulnerable SoftwareAffected Versions
Agile Plm
Version 9.3.6
Application Testing Suite
Version 13.3.0.1
Autovue
Version 21.0.2
Oracle
Banking Corporate Lending Process Management
Version 14.2
Banking Corporate Lending Process Management
Version 14.3
Banking Corporate Lending Process Management
Version 14.5
Oracle
Banking Credit Facilities Process Management
Version 14.2
Banking Credit Facilities Process Management
Version 14.3
Banking Credit Facilities Process Management
Version 14.5
Oracle
Banking Extensibility Workbench
Version 14.2
Banking Extensibility Workbench
Version 14.3
Banking Extensibility Workbench
Version 14.5
Oracle
Banking Supply Chain Finance
Version 14.2
Banking Supply Chain Finance
Version 14.3
Banking Supply Chain Finance
Version 14.5
Banking Treasury Management
Version 14.4
Oracle
Banking Virtual Account Management
Version 14.2.0
Banking Virtual Account Management
Version 14.3.0
Banking Virtual Account Management
Version 14.5.0
Blockchain Platform
Up to 21.1.2
Oracle
Commerce Platform
From 11.3.0 to 11.3.2
Commerce Platform
Version 11.2.0
Oracle
Communications Billing And Revenue Management
Version 12.0.0.3.0
Communications Billing And Revenue Management
Version 7.5.0.23.0
Communications Cloud Native Core Policy
Version 1.14.0
Communications Cloud Native Core Unified Data Repository
Version 1.4.0
Communications Convergent Charging Controller
Version 12.0.4.0.0
Communications Diameter Signaling Route
From 8.0.0.0 to 8.5.0.0
Communications Element Manager
From 8.2.0.0 to 8.2.4.0
Communications Evolved Communications Application Server
Version 7.1
Communications Network Charging And Control
Version 12.0.4.0.0
Communications Policy Management
Version 12.5.0
Communications Services Gatekeeper
Version 7.0
Communications Session Report Manager
From 8.0.0.0 to 8.2.2.1
Communications Session Route Manager
From 8.2.0.0 to 8.2.2.1
Communications Unified Inventory Management
Version 7.4.1
Data Integrator
Version 12.2.1.4.0
Goldengate Application Adapters
Version 19.1.0.0.0
Oracle
Insurance Policy Administration
From 11.1.0 to 11.3.0
Insurance Policy Administration
Version 11.0.2
Oracle
Insurance Rules Palette
From 11.1.0 to 11.3.0
Insurance Rules Palette
Version 11.0.2
Jd Edwards Enterpriseone Orchestrator
Before 9.2.5.3
Jd Edwards Enterpriseone Tools
Before 9.2.5.3
Oracle
Primavera Gateway
From 17.12.0 to 17.12.11
Primavera Gateway
From 18.8.0 to 18.8.11
Primavera Gateway
From 19.12.0 to 19.12.10
Primavera Gateway
Version 20.12.0
Oracle
Primavera Unifier
From 17.7 to 17.12
Primavera Unifier
From 18.8 to 19.12
Primavera Unifier
Version 20.12
Retail Customer Management And Segmentation Foundation
From 16.0 to 19.0
Retail Merchandising System
Version 15.0.3
Oracle
Retail Service Backbone
Version 14.1.3.2
Retail Service Backbone
Version 15.0.3.1
Retail Service Backbone
Version 16.0.3.0
Oracle
Retail Xstore Point Of Service
Version 16.0.6
Retail Xstore Point Of Service
Version 17.0.4
Retail Xstore Point Of Service
Version 18.0.3
Retail Xstore Point Of Service
Version 19.0.2
Oracle
Webcenter Portal
Version 12.2.1.3.0
Webcenter Portal
Version 12.2.1.4.0

Related CWEs

CWE-502
Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (20)

Source: cve@mitre.org
PatchThird Party Advisory
Source: cve@mitre.org
Mailing ListThird Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
PatchThird Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
PatchThird Party Advisory
Source: cve@mitre.org
PatchThird Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory

Timeline

No history available yet.