CVE Catalog
CVE-2020-14195
HighCVSS 8.1Exploitation Probability (EPSS)
Very high risk4.55%
91th percentile - higher than 91% of all known CVEs
Summary
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity).
Risk Assessment
The vulnerability may lead to remote code execution or privilege escalation if the application processes untrusted JSON data with typing enabled.
Recommendation
Update jackson-databind to version 2.9.10.5 or later. Consider disabling typing or using secure configurations.
Original NVD description (English source)
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity).