CVE-2020-14061

fasterxml jackson-databind, netapp active iq unified manager, netapp steelstore cloud integrated storage +12 lainnya

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2020-14061

Katalog CVE

CVSS 8.1 · High EPSS 4,5%

Kerentanan Deserialization of Untrusted Data pada fasterxml jackson-databind, netapp active iq unified manager +13 lainnya. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory, oracle.jms.AQjmsXATopicConnectionFactory, oracle.jms.AQjmsTopicConnectionFactory, oracle.jms.AQjmsXAQueueConnectionFactory, and oracle.jms.AQjmsXAConnectionFactory (aka weblogic/oracle-aqjms).

Rincian

Terbit di NVD
14 Juni 2020
Terakhir diubah
25 Agustus 2026
Status NVD
Modified
CVSS 3.1
8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-502: Deserialization of Untrusted Data
EPSS (30 hari)
4,5% peluang dieksploitasi; lebih tinggi dari 91,2% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
fasterxml jackson-databind Versi 2.9.0 hingga sebelum 2.9.10.5
netapp active iq unified manager Versi 7.3 dan sesudahnya
netapp active iq unified manager Versi 9.5 dan sesudahnya
netapp steelstore cloud integrated storage Semua versi
debian debian linux Versi 8.0
oracle agile product lifecycle management Versi 9.3.6
oracle autovue for agile product lifecycle management Versi 21.0.2
oracle banking digital experience Versi 18.1
oracle banking digital experience Versi 18.2
oracle banking digital experience Versi 18.3
oracle banking digital experience Versi 19.1
oracle banking digital experience Versi 19.2
oracle banking digital experience Versi 20.1
oracle communications calendar server Versi 8.0.0.4.0
oracle communications contacts server Versi 8.0.0.5.0
oracle communications diameter signaling router Versi 8.0.0 hingga 8.2.2
oracle communications element manager Versi 8.2.0 hingga 8.2.2
oracle communications evolved communications application server Versi 7.1
oracle communications instant messaging server Versi 10.0.1.4.0
oracle communications session report manager Versi 8.2.0 hingga 8.2.2
oracle communications session route manager Versi 8.2.0 hingga 8.2.2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.