CVE Catalog
CVE-2020-24616
HighCVSS 8.1Exploitation Probability (EPSS)
Very high risk9.42%
95th percentile - higher than 95% of all known CVEs
Summary
FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).
Risk Assessment
The vulnerability may allow an attacker to perform unauthorized actions, threatening data integrity and confidentiality.
Recommendation
Update jackson-databind to version 2.9.10.6 or later to mitigate the vulnerability.
Original NVD description (English source)
FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).