CVE Catalog
CVE-2020-9548
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk18.35%
97th percentile - higher than 97% of all known CVEs
Summary
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).
Risk Assessment
The vulnerability may allow an attacker to perform unauthorized actions by exploiting unsafe deserialization gadgets, potentially leading to remote code execution or data integrity compromise.
Recommendation
It is recommended to immediately upgrade jackson-databind to version 2.9.10.4 or later and disable unsafe typing if not required.
Original NVD description (English source)
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).