Strix
26.1K

CVE-2020-36182

HIGHCVSS 8.1/10EPSS 5.02%

Last modified

CVE-2020-36182 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS.. EPSS estimates a 5.02% chance of exploitation in the next 30 days.

Description

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS.

Metrics

CVSS 3.1
8.1/10

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
5.02%

91.2th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
FasterxmlJackson-Databind>= 2.0.0, < 2.6.7.5
FasterxmlJackson-Databind>= 2.7.0, < 2.9.10.8
NetappCloud BackupAll versions
NetappService Level ManagerAll versions
DebianDebian Linux9.0
OracleAgile Plm9.3.6
OracleApplication Testing Suite13.3.0.1
OracleAutovue For Agile Product Lifecycle Management21.0.2
OracleBanking Corporate Lending Process Management14.2
OracleBanking Corporate Lending Process Management14.3
OracleBanking Corporate Lending Process Management14.5
OracleBanking Credit Facilities Process Management14.2
OracleBanking Credit Facilities Process Management14.3
OracleBanking Credit Facilities Process Management14.5
OracleBanking Extensibility Workbench14.2
OracleBanking Extensibility Workbench14.3
OracleBanking Extensibility Workbench14.5
OracleBanking Supply Chain Finance14.2
OracleBanking Supply Chain Finance14.3
OracleBanking Supply Chain Finance14.5
OracleBanking Treasury Management4.4
OracleBanking Virtual Account Management14.2.0
OracleBanking Virtual Account Management14.3.0
OracleBanking Virtual Account Management14.5.0
OracleBlockchain Platform<= 21.1.2
OracleCommerce Platform>= 11.3.0, <= 11.3.2
OracleCommerce Platform11.2.0
OracleCommunications Billing And Revenue Management7.5.0.23.0
OracleCommunications Billing And Revenue Management12.0.0.3.0
OracleCommunications Cloud Native Core Policy1.14.0
OracleCommunications Cloud Native Core Unified Data Repository1.4.0
OracleCommunications Convergent Charging Controller12.0.4.0.0
OracleCommunications Diameter Signaling Route>= 8.0.0.0, <= 8.5.0.0
OracleCommunications Element Manager>= 8.2.0.0, <= 8.2.4.0
OracleCommunications Evolved Communications Application Server7.1
OracleCommunications Instant Messaging Server10.0.1.5.0
OracleCommunications Network Charging And Control12.0.4.0.0
OracleCommunications Offline Mediation Controller12.0.0.3
OracleCommunications Policy Management12.5.0
OracleCommunications Pricing Design Center12.0.0.4.0
OracleCommunications Services Gatekeeper7.0
OracleCommunications Session Report Manager>= 8.0.0.0, <= 8.2.2.1
OracleCommunications Session Route Manager>= 8.2.0.0, <= 8.2.2.1
OracleCommunications Unified Inventory Management7.4.1
OracleData Integrator12.2.1.4.0
OracleDocumaker12.6.0
OracleDocumaker12.6.3
OracleDocumaker12.6.4
OracleGoldengate Application Adapters19.1.0.0.0
OracleInsurance Policy Administration>= 11.1.0, <= 11.3.0

Showing 50 of 75 affected configurations. See NVD for the full list.

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2020-36182?
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS.
How severe is CVE-2020-36182?
CVE-2020-36182 has a CVSS score of 8.1/10 (HIGH severity). The EPSS model estimates a 5.02% probability of exploitation in the next 30 days.
How do I fix CVE-2020-36182?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2020-36182?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST