SecBoard
Zurück zur CVE-Übersicht

CVE-2020-35728

HIGH(8.1)

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Risk Signal Score24/100 — NIEDRIG
  • CVSS 8.1 — Hoch

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

12.5%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

8.1

Technische Schwere

Beschreibung

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).

Betroffene Produkte

  • cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
  • cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:service_level_manager:-:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:autovue:21.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:banking_extensibility_workbench:14.2:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:banking_extensibility_workbench:14.3:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:banking_extensibility_workbench:14.5:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:banking_supply_chain_finance:14.2:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:banking_supply_chain_finance:14.3:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:banking_supply_chain_finance:14.5:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:banking_treasury_management:14.4:*:*:*:*:*:*:*

Referenzen