Strix
26.1K

CVE-2020-10969

HIGHCVSS 8.8/10EPSS 3.47%

Last modified

CVE-2020-10969 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane.. EPSS estimates a 3.47% chance of exploitation in the next 30 days.

Description

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane.

Metrics

CVSS 3.1
8.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Probability
3.47%

87.6th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
FasterxmlJackson-Databind>= 2.7.0, < 2.7.9.7
FasterxmlJackson-Databind>= 2.8.0, < 2.8.11.6
FasterxmlJackson-Databind>= 2.9.0, < 2.9.10.4
DebianDebian Linux8.0
NetappSteelstore Cloud Integrated StorageAll versions
OracleAgile Plm9.3.6
OracleAutovue For Agile Product Lifecycle Management21.0.2
OracleBanking Digital Experience18.1
OracleBanking Digital Experience18.2
OracleBanking Digital Experience18.3
OracleBanking Digital Experience19.1
OracleBanking Digital Experience19.2
OracleBanking Digital Experience20.1
OracleBanking Platform>= 2.4.0, <= 2.9.0
OracleCommunications Calendar Server8.0.0.4.0
OracleCommunications Contacts Server8.0.0.4.0
OracleCommunications Contacts Server8.0.0.5.0
OracleCommunications Diameter Signaling Router>= 8.0.0, <= 8.2.2
OracleCommunications Element Manager>= 8.2.0, <= 8.2.2
OracleCommunications Evolved Communications Application Server7.1
OracleCommunications Instant Messaging Server10.0.1.4.0
OracleCommunications Network Charging And Control>= 12.0.0, <= 12.0.3
OracleCommunications Network Charging And Control6.0.1
OracleCommunications Session Report Manager>= 8.2.0, <= 8.2.2
OracleCommunications Session Route Manager>= 8.2.0, <= 8.2.2
OracleEnterprise Manager Base Platform13.3.0.0
OracleEnterprise Manager Base Platform13.4.0.0
OracleFinancial Services Analytical Applications Infrastructure>= 8.0.6, <= 8.1.0
OracleFinancial Services Institutional Performance Analytics8.0.6
OracleFinancial Services Institutional Performance Analytics8.0.7
OracleFinancial Services Institutional Performance Analytics8.1.0
OracleFinancial Services Price Creation And Discovery8.0.6
OracleFinancial Services Price Creation And Discovery8.0.7
OracleFinancial Services Retail Customer Analytics8.0.6
OracleGlobal Lifecycle Management Opatch< 12.2.0.1.20
OracleInsurance Policy Administration J2ee11.0.2.25
OracleInsurance Policy Administration J2ee11.1.0.15
OracleJd Edwards Enterpriseone Orchestrator< 9.2.4.2
OracleJd Edwards Enterpriseone Tools< 9.2.4.2
OraclePrimavera Unifier>= 17.7, <= 17.12
OraclePrimavera Unifier16.1
OraclePrimavera Unifier16.2
OraclePrimavera Unifier18.8
OraclePrimavera Unifier19.12
OracleRetail Merchandising System15.0
OracleRetail Sales Audit14.1
OracleRetail Service Backbone14.1
OracleRetail Service Backbone15.0
OracleRetail Service Backbone16.0
OracleRetail Xstore Point Of Service15.0

Showing 50 of 56 affected configurations. See NVD for the full list.

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2020-10969?
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane.
How severe is CVE-2020-10969?
CVE-2020-10969 has a CVSS score of 8.8/10 (HIGH severity). The EPSS model estimates a 3.47% probability of exploitation in the next 30 days.
How do I fix CVE-2020-10969?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2020-10969?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST