Strix
26.1K

CVE-2020-8840

CRITICALCVSS 9.8/10EPSS 26.59%

Last modified

CVE-2020-8840 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.. EPSS estimates a 26.59% chance of exploitation in the next 30 days.

Description

FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.

Metrics

CVSS 3.1
9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
26.59%

97.8th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
FasterxmlJackson-Databind>= 2.0.0, < 2.7.9.7
FasterxmlJackson-Databind>= 2.8.0, < 2.8.11.5
FasterxmlJackson-Databind>= 2.9.0, < 2.9.10.3
DebianDebian Linux8.0
NetappOncommand Api ServicesAll versions
NetappOncommand Workflow AutomationAll versions
NetappService Level ManagerAll versions
NetappSteelstore Cloud Integrated StorageAll versions
HuaweiOceanstor 9000 Firmwarev300r006c20
HuaweiOceanstor 9000 Firmwarev300r006c20spc100
HuaweiOceanstor 9000 Firmwarev300r006c20spc200
HuaweiOceanstor 9000 Firmwarev300r006c20spc300
OracleGlobal Lifecycle Management Opatch< 11.2.0.3.23
OracleGlobal Lifecycle Management Opatch>= 12.2.0.1.0, < 12.2.0.1.19
OracleGlobal Lifecycle Management Opatch>= 13.9.4.0.0, < 13.9.4.2.1

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2020-8840?
FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.
How severe is CVE-2020-8840?
CVE-2020-8840 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 26.59% probability of exploitation in the next 30 days.
How do I fix CVE-2020-8840?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2020-8840?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST