peter bassill · operator
$ cve CVE-2020-9547 JSON

CVE-2020-9547

9.8
CRITICAL · CVSS 3.1 · EPSS 18.4% (pctl 97)

Patch early

EPSS 18.4% — above the 10% action threshold.

Description

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).

Scoring

CVSS9.8 (CRITICAL, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS18.38% — more likely to be exploited than 97% of all CVEs
WeaknessCWE-502
On CISA KEVno
Public exploitnone known
Published2020-03-02
Last modified2026-06-17

Affected (16)

VendorProduct
debiandebian linux
fasterxmljackson-databind
netappactive iq unified manager
oracleautovue for agile product lifecycle management
oraclebanking platform
oraclecommunications contacts server
oraclecommunications evolved communications application server
oraclecommunications instant messaging server
oraclecommunications network charging and control
oracleenterprise manager base platform
oracleglobal lifecycle management opatch
oraclejd edwards enterpriseone orchestrator
oraclejd edwards enterpriseone tools
oracleprimavera unifier
oracleretail xstore point of service
oracleweblogic server

References

→ the Explorer  ·  watch your stack  ·  NVD