Miggo Logo
Miggo Vulnerability Database
→
CVE-2020-11620

CVE-2020-11620:
jackson-databind mishandles the interaction between serialization gadgets and typing

8.1

CVSS Score
3.1

Basic Information

CVE ID
CVE-2020-11620
GHSA ID
GHSA-h4rc-386g-6m85
EPSS Score
0.8385%
CWE
CWE-502
Published
4/23/2020
Updated
3/15/2024
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
com.fasterxml.jackson.core:jackson-databindmaven>= 2.9.0, <= 2.9.10.32.9.10.4

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis:
In progress

WAF Protection Rules

WAF Rule

**st*rXML j**kson-**t**in* *.x ***or* *.*.**.* mis**n*l*s t** int*r**tion **tw**n s*ri*liz*tion *****ts *n* typin*, r*l*t** to or*.*p****.*ommons.j*lly.impl.*m****** (*k* *ommons-j*lly).

Reasoning

No *n*lysis *v*il**l*