Miggo Logo
Miggo Vulnerability Database
→
CVE-2020-10673

CVE-2020-10673: jackson-databind mishandles the interaction between serialization gadgets and typing

8.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2020-10673
GHSA ID
GHSA-fqwf-pjwf-7vqv
EPSS Score
0.95262%
CWE
CWE-502
Published
5/15/2020
Updated
7/3/2024
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
com.fasterxml.jackson.core:jackson-databindmaven>= 2.7.0, < 2.9.10.42.9.10.4
com.fasterxml.jackson.core:jackson-databindmaven>= 2.0.0, < 2.6.7.42.6.7.4

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis:
In progress

WAF Protection Rules

WAF Rule

**st*rXML j**kson-**t**in* *.x ***or* *.*.**.* *n* *.*.*.* mis**n*l*s t** int*r**tion **tw**n s*ri*liz*tion *****ts *n* typin*, r*l*t** to *om.**u**o.*on*i*.typ*s.R*sour**R** (*k* **u**o-qu*r*us).

Reasoning

No *n*lysis *v*il**l*