En resumen
- CVE-2020-10650 es una vulnerabilidad ALTO (CVSS 8.1) que afecta a com.fasterxml.jackson.core:jackson-databind, jackson-databind (fasterxml), retail merchandising system (oracle).
- Probabilidad de explotación en los próximos 30 días (EPSS): 3.6%, mayor que el 89.5% de las vulnerabilidades.
- Solución: actualizar a 2.9.10.4 o posterior.
Description
The com.fasterxml.jackson.core:jackson-databind library before version 2.9.10.4 is vulnerable to an Unsafe Deserialization vulnerability when handling interactions related to the class ignite-jta.
NVD description
A deserialization flaw was discovered in jackson-databind through 2.9.10.4. It could allow an unauthenticated user to perform code execution via ignite-jta or quartz-core: org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider.
Más vulnerabilidades de com.fasterxml.jackson.core:jackson-databind
Ver todo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free