CVE-2020-24750 FasterXML jackson-databind
| Affected software | FasterXML jackson-databind |
|---|---|
| Severity | 8.1 High CVSS 3.1 2 scores |
| Fixed in | 2.6.7.5, 2.9.10.6 |
| Weakness | Deserialization of untrusted data (CWE-502) |
| Published | 17 Sep 2020 |
| Updated | 8 Oct 2026 |
Description
FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.
Exploitation status
No public exploit
No exploit has been reported in the sources we check. The 1 repository below are public GitHub repositories with fewer than 5 stars.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment exploitation: none
- Indexed PoC 1 indexed, none at 5+ stars
- EPSS 7.3% chance in 30 days
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | CVE-2020-24750 | 1 | 2020-05-27 |
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full
- Action available security rule
- Review human Researcher
- Record active
| Decided by | Manual classification of this CVE in the legacy dataset |
|---|---|
| Finding | A manual classification set this CVE's status to Protected by Waratek. |
How to mitigate CVE-2020-24750
Upgrade FasterXML jackson-databind to a release that fixes it: 2.6.7.5 or 2.9.10.6. Until you can, Waratek RASP blocks exploitation with a security rule that blocks this kind of attack. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
CVSS
8.1 HIGH
v3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
2 metrics
CVSS
8.1 HIGH v3.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
2 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 8.1 | HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
NVD | Primary | published |
| CVSS 2.0 | 6.8 | none | AV:N/AC:M/Au:N/C:P/I:P/A:P |
NVD | Primary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update April 2022 ↗ | CPU | 2022-Q2 | Oracle Blockchain Platform / BCS Console (jackson-databind) (Prior to 21.1.2) |
| Oracle Critical Patch Update January 2022 ↗ | CPU | 2022-Q1 | Oracle Communications Applications / Installation (jackson-databind) (12.0.0.4.0) Oracle Communications Applications / Installer (jackson-databind) (12.0.0.3) Oracle Communications Applications / PresenceApi (jackson-databind) (10.0.1.5.0) |
| Oracle Critical Patch Update October 2021 ↗ | CPU | 2021-Q4 | Oracle Communications / Policy (jackson-databind) (12.5.0) Oracle Communications / Reports (jackson-databind) (8.0.0.0-8.2.2.1) Oracle Communications / Reports (jackson-databind) (8.2.0.0-8.2.2.1) Oracle Communications / Security (jackson-databind) (8.2.0.0-8.2.4.0) Oracle Financial Services Applications / Credit Appraisal (jackson-databind) (14.2, 14.3, 14.5) Oracle Financial Services Applications / Invoice (jackson-databind) (14.2, 14.3, 14.5) Oracle Financial Services Applications / Lending (jackson-databind) (14.2, 14.3, 14.5) |
| Oracle Critical Patch Update July 2021 ↗ | CPU | 2021-Q3 | Oracle Financial Services Applications / Onboarding (jackson-databind) (14.2,14.3, 14.5) Oracle Siebel CRM / Services (jackson-databind) (21.5 and Prior) |
| Oracle Critical Patch Update April 2021 ↗ | CPU | 2021-Q2 | Oracle Communications Applications / Contact Sharing (jackson-databind) (8.0) Oracle Communications Applications / Event Reminders (jackson-databind) (8.0) Oracle Communications Applications / Security (jackson-databind) (8.1) Oracle Fusion Middleware / General and Misc (jackson-databind) (11.1.1.5.0) |
| Oracle Critical Patch Update January 2021 ↗ | CPU | 2021-Q1 | Oracle Communications / IDIH (jackson-databind) (8.0.0-8.2.2) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Blockchain Platform | BCS Console (jackson-databind) | Prior to 21.1.2 | |
| Oracle Communications | IDIH (jackson-databind) | 8.0.0-8.2.2 | |
| Oracle Communications | Policy (jackson-databind) | 12.5.0 | 12.5.0 |
| Oracle Communications | Reports (jackson-databind) | 8.0.0.0-8.2.2.1 | |
| Oracle Communications | Security (jackson-databind) | 8.2.0.0-8.2.4.0 | |
| Oracle Communications Applications | Contact Sharing (jackson-databind) | 8.0 | 8.0 |
| Oracle Communications Applications | Event Reminders (jackson-databind) | 8.0 | 8.0 |
| Oracle Communications Applications | Installation (jackson-databind) | 12.0.0.4.0 | 12.0.0.4.0 |
| Oracle Communications Applications | Installer (jackson-databind) | 12.0.0.3 | 12.0.0.3 |
| Oracle Communications Applications | PresenceApi (jackson-databind) | 10.0.1.5.0 | 10.0.1.5.0 |
| Oracle Communications Applications | Security (jackson-databind) | 8.1 | 8.1 |
| Oracle Financial Services Applications | Credit Appraisal (jackson-databind) | 14.2, 14.3, 14.5 | 14.2 · 14.3 · 14.5 |
| Oracle Financial Services Applications | Invoice (jackson-databind) | 14.2, 14.3, 14.5 | 14.2 · 14.3 · 14.5 |
| Oracle Financial Services Applications | Lending (jackson-databind) | 14.2, 14.3, 14.5 | 14.2 · 14.3 · 14.5 |
| Oracle Financial Services Applications | Onboarding (jackson-databind) | 14.2,14.3, 14.5 | 14.2 · 14.3 · 14.5 |
| Oracle Fusion Middleware | General and Misc (jackson-databind) | 11.1.1.5.0 | 11.1.1.5.0 |
| Oracle Siebel CRM | Services (jackson-databind) | 21.5 and Prior |
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
com.fasterxml.jackson.core:jackson-databind |
2.0 | 2.6.7.5 |
unbounded |
com.fasterxml.jackson.core:jackson-databind |
2.7.0 | 2.9.10.6 |
unbounded |
Products and versions
27 products, 39 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| osv | com.fasterxml.jackson.core | jackson-databind | generic | ≥ 2.0 and ＜ 2.6.7.5 · ≥ 2.7.0 and ＜ 2.9.10.6 |
| nvd | debian | debian linux | generic | 9.0 |
| nvd | fasterxml | jackson-databind | generic | ≥ 2.0.0 and ＜ 2.6.7.5 · ≥ 2.7.0 and ＜ 2.9.10.6 |
| nvd | oracle | agile product lifecycle management | generic | 9.3.6 |
| nvd | oracle | application testing suite | generic | 13.3.0.1 |
| nvd | oracle | autovue for agile product lifecycle management | generic | 21.0.2 |
| nvd | oracle | banking corporate lending process management | generic | 14.2.0 · 14.3.0 · 14.5.0 |
| nvd | oracle | banking credit facilities process management | generic | 14.2.0 · 14.3.0 · 14.5.0 |
| nvd | oracle | banking liquidity management | generic | 14.2 · 14.3 · 14.5 |
| nvd | oracle | banking supply chain finance | generic | 14.2.0 · 14.3.0 · 14.5.0 |
| nvd | oracle | blockchain platform | generic | ＜ 21.1.2 |
| nvd | oracle | communications calendar server | generic | 8.0 · 8.0.0.4.0 |
| nvd | oracle | communications contacts server | generic | 8.0 · 8.0.0.5.0 |
| nvd | oracle | communications diameter signaling router | generic | ≥ 8.0.0 and ≤ 8.2.2 |
| nvd | oracle | communications element manager | generic | ≥ 8.2.0 and ≤ 8.2.4.0 |
| nvd | oracle | communications instant messaging server | generic | 10.0.1.5.0 |
| nvd | oracle | communications messaging server | generic | 8.1 |
| nvd | oracle | communications offline mediation controller | generic | 12.0.0.3.0 |
| nvd | oracle | communications policy management | generic | 12.5.0 |
| nvd | oracle | communications pricing design center | generic | 12.0.0.4.0 |
| nvd | oracle | communications services gatekeeper | generic | 7.0 |
| nvd | oracle | communications session report manager | generic | ≥ 8.0.0.0 and ≤ 8.2.2.1 |
| nvd | oracle | communications session route manager | generic | ≥ 8.2.0 and ≤ 8.2.2.1 |
| nvd | oracle | communications unified inventory management | generic | 7.4.1 |
| nvd | oracle | identity manager connector | generic | 11.1.1.5.0 |
| nvd | oracle | siebel core - server framework | generic | ≤ 21.5 |
| nvd | oracle | siebel ui framework | generic | ≤ 21.2 |
Earlier manual review
A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.
## Manual Classification Context **Labels:** HTTP, EVENT REMINDERS (JACKSON-DATABIND), CONTACT SHARING (JACKSON-DATABIND), SERVICES (JACKSON-DATABIND), SECURITY (JACKSON-DATABIND), GENERAL AND MISC (JACKSON-DATABIND), IDIH (JACKSON-DATABIND), ONBOARDING (JACKSON-DATABIND), NO AUTH REMOTE EXPLOIT, POLICY (JACKSON-DATABIND), REPORTS (JACKSON-DATABIND), LENDING (JACKSON-DATABIND), CREDIT APPRAISAL (JACKSON-DATABIND), INVOICE (JACKSON-DATABIND), PRESENCEAPI (JACKSON-DATABIND), INSTALLER (JACKSON-DATABIND), INSTALLATION (JACKSON-DATABIND) **Products:** ORACLE COMMUNICATIONS MESSAGING SERVER, ORACLE COMMUNICATIONS DIAMETER SIGNALING ROUTER (DSR), ORACLE FUSION MIDDLEWARE, ORACLE SIEBEL CRM, ORACLE FINANCIAL SERVICES APPLICATIONS, ORACLE COMMUNICATIONS, ORACLE IDENTITY MANAGER CONNECTOR, JACKSON-DATABIND, ORACLE COMMUNICATIONS CALENDAR SERVER, SIEBEL CORE - SERVER FRAMEWORK, ORACLE COMMUNICATIONS APPLICATIONS, ORACLE BANKING LIQUIDITY MANAGEMENT, ORACLE COMMUNICATIONS CONTACTS SERVER, ORACLE COMMUNICATIONS ELEMENT MANAGER, ORACLE COMMUNICATIONS POLICY MANAGEMENT, ORACLE COMMUNICATIONS SESSION REPORT MANAGER, ORACLE COMMUNICATIONS SESSION ROUTE MANAGER, ORACLE BANKING CORPORATE LENDING PROCESS MANAGEMENT, ORACLE BANKING CREDIT FACILITIES PROCESS MANAGEMENT, ORACLE BANKING SUPPLY CHAIN FINANCE, ORACLE COMMUNICATIONS INSTANT MESSAGING SERVER, ORACLE COMMUNICATIONS OFFLINE MEDIATION CONTROLLER, ORACLE COMMUNICATIONS PRICING DESIGN CENTER
References
Timeline
Timeline
| Published | 2020-09-17 | By the CVE Program. |
|---|---|---|
| NVD record modified | 2026-10-08 | NVD's own last-modified date for this record. |