CVE-2020-14061

Name: CVE-2020-14061
Creator: NVD / NIST
Published: 2020-06-14T20:15:10.027+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 8.1/10EPSS 4.42%

Last modified Jun 17, 2026

CVE-2020-14061 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory, oracle.jms.AQjmsXATopicConnectionFactory, oracle.jms.AQjmsTopicConnectionFactory, oracle.jms.AQjmsXAQueueConnectionFactory, and oracle.jms.AQjmsXAConnectionFactory (aka weblogic/oracle-aqjms).. EPSS estimates a 4.42% chance of exploitation in the next 30 days.

Description

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory, oracle.jms.AQjmsXATopicConnectionFactory, oracle.jms.AQjmsTopicConnectionFactory, oracle.jms.AQjmsXAQueueConnectionFactory, and oracle.jms.AQjmsXAConnectionFactory (aka weblogic/oracle-aqjms).

Metrics

CVSS 3.1

8.1/10

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

4.42%

90.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Fasterxml	Jackson-Databind	>= 2.9.0, < 2.9.10.5
Netapp	Active Iq Unified Manager	>= 7.3
Netapp	Active Iq Unified Manager	>= 9.5
Netapp	Steelstore Cloud Integrated Storage	All versions
Debian	Debian Linux	8.0
Oracle	Agile Plm	9.3.6
Oracle	Autovue For Agile Product Lifecycle Management	21.0.2
Oracle	Banking Digital Experience	18.1
Oracle	Banking Digital Experience	18.2
Oracle	Banking Digital Experience	18.3
Oracle	Banking Digital Experience	19.1
Oracle	Banking Digital Experience	19.2
Oracle	Banking Digital Experience	20.1
Oracle	Communications Calendar Server	8.0.0.4.0
Oracle	Communications Contacts Server	8.0.0.5.0
Oracle	Communications Diameter Signaling Router	>= 8.0.0, <= 8.2.2
Oracle	Communications Element Manager	>= 8.2.0, <= 8.2.2
Oracle	Communications Evolved Communications Application Server	7.1
Oracle	Communications Instant Messaging Server	10.0.1.4.0
Oracle	Communications Session Report Manager	>= 8.2.0, <= 8.2.2
Oracle	Communications Session Route Manager	>= 8.2.0, <= 8.2.2

References

https://github.com/FasterXML/jackson-databind/issues/2698Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/07/msg00001.htmlMailing List, Third Party Advisory
https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
https://security.netapp.com/advisory/ntap-20200702-0003/Third Party Advisory
https://www.oracle.com//security-alerts/cpujul2021.htmlThird Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.htmlThird Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.htmlThird Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.htmlThird Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.htmlThird Party Advisory
https://github.com/FasterXML/jackson-databind/issues/2698Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/07/msg00001.htmlMailing List, Third Party Advisory
https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
https://security.netapp.com/advisory/ntap-20200702-0003/Third Party Advisory
https://www.oracle.com//security-alerts/cpujul2021.htmlThird Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.htmlThird Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.htmlThird Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.htmlThird Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.htmlThird Party Advisory

Timeline

Published: Jun 14, 2020
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2020-14061?

How severe is CVE-2020-14061?

CVE-2020-14061 has a CVSS score of 8.1/10 (HIGH severity). The EPSS model estimates a 4.42% probability of exploitation in the next 30 days.

How do I fix CVE-2020-14061?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2020-14061?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST