CVE Catalog
CVE-2021-20190
HighCVSS 8.1Exploitation Probability (EPSS)
Very high risk7.48%
94th percentile - higher than 94% of all known CVEs
Summary
A flaw in jackson-databind before 2.9.10.7 mishandles the interaction between serialization gadgets and typing. The highest threat is to data confidentiality, integrity, and system availability.
Risk Assessment
An attacker could exploit this vulnerability to compromise data confidentiality, integrity, and cause system unavailability.
Recommendation
Update jackson-databind to version 2.9.10.7 or later.
Original NVD description (English source)
A flaw was found in jackson-databind before 2.9.10.7. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.