CVE Catalog
CVE-2020-10673
HighCVSS 8.8Exploitation Probability (EPSS)
Very high risk8.03%
94th percentile - higher than 94% of all known CVEs
Summary
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).
Risk Assessment
An attacker could exploit this vulnerability to achieve remote code execution or unauthorized data access if the application uses jackson-databind with typing enabled.
Recommendation
Update jackson-databind to version 2.9.10.4 or later. If possible, disable typing or apply a safe typing policy.
Original NVD description (English source)
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).