peter bassill · operator
$ cve CVE-2020-9546 JSON

CVE-2020-9546

9.8
CRITICAL · CVSS 3.1 · EPSS 4.6% (pctl 91)

In your normal cycle

Critical by CVSS (9.8), but no sign of active exploitation.

Description

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).

Scoring

CVSS9.8 (CRITICAL, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS4.61% — more likely to be exploited than 91% of all CVEs
WeaknessCWE-502
On CISA KEVno
Public exploitnone known
Published2020-03-02
Last modified2026-10-07

Affected (31)

VendorProduct
debiandebian linux
fasterxmljackson-databind
netappactive iq unified manager
oracleagile product lifecycle management
oracleautovue for agile product lifecycle management
oraclebanking digital experience
oraclebanking platform
oraclecommunications calendar server
oraclecommunications contacts server
oraclecommunications diameter signaling router
oraclecommunications element manager
oraclecommunications evolved communications application server
oraclecommunications instant messaging server
oraclecommunications network charging and control
oraclecommunications session report manager
oraclecommunications session route manager
oracleenterprise manager base platform
oraclefinancial services analytical applications infrastructure
oraclefinancial services institutional performance analytics
oraclefinancial services price creation and discovery
oraclefinancial services retail customer analytics
oracleglobal lifecycle management opatch
oracleinsurance policy administration j2ee
oraclejd edwards enterpriseone orchestrator
oraclejd edwards enterpriseone tools
oracleprimavera unifier
oracleretail merchandising system
oracleretail sales audit
oracleretail service backbone
oracleretail xstore point of service
oracleweblogic server

References

→ the Explorer  ·  watch your stack  ·  NVD