peter bassill · operator
$ cve CVE-2020-9548 JSON

CVE-2020-9548

9.8
CRITICAL · CVSS 3.1 · EPSS 18.3% (pctl 97)

Patch early

EPSS 18.3% — above the 10% action threshold.

Description

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).

Scoring

CVSS9.8 (CRITICAL, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS18.35% — more likely to be exploited than 97% of all CVEs
WeaknessCWE-502
On CISA KEVno
Public exploitnone known
Published2020-03-02
Last modified2026-08-25

Affected (25)

VendorProduct
debiandebian linux
fasterxmljackson-databind
netappactive iq unified manager
oracleagile product lifecycle management
oracleautovue for agile product lifecycle management
oraclebanking digital experience
oraclebanking platform
oraclecommunications calendar server
oraclecommunications contacts server
oraclecommunications diameter signaling router
oraclecommunications element manager
oraclecommunications evolved communications application server
oraclecommunications instant messaging server
oraclecommunications network charging and control
oraclecommunications session report manager
oraclecommunications session route manager
oracleenterprise manager base platform
oracleglobal lifecycle management opatch
oraclejd edwards enterpriseone orchestrator
oraclejd edwards enterpriseone tools
oracleprimavera unifier
oracleretail merchandising system
oracleretail sales audit
oracleretail xstore point of service
oracleweblogic server

References

→ the Explorer  ·  watch your stack  ·  NVD