Em resumo
- CVE-2020-10650 é uma vulnerabilidade ALTO (CVSS 8.1) que afeta com.fasterxml.jackson.core:jackson-databind, jackson-databind (fasterxml), retail merchandising system (oracle).
- Chance de exploração nos próximos 30 dias (EPSS): 3.6%, maior que 89.5% das vulnerabilidades.
- Correção: atualize para 2.9.10.4 ou posterior.
Description
The com.fasterxml.jackson.core:jackson-databind library before version 2.9.10.4 is vulnerable to an Unsafe Deserialization vulnerability when handling interactions related to the class ignite-jta.
NVD description
A deserialization flaw was discovered in jackson-databind through 2.9.10.4. It could allow an unauthenticated user to perform code execution via ignite-jta or quartz-core: org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider.
Mais vulnerabilidades de com.fasterxml.jackson.core:jackson-databind
Ver tudo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free