CVE Catalog
CVE-2020-24750
HighCVSS 8.1Exploitation Probability (EPSS)
Very high risk7.33%
94th percentile - higher than 94% of all known CVEs
Summary
FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.
Risk Assessment
The vulnerability could allow an attacker to perform remote code execution or unauthorized access to resources if the application uses jackson-databind with typing.
Recommendation
Update jackson-databind to version 2.9.10.6 or later. Consider disabling typing or applying secure practices.
Original NVD description (English source)
FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.