Search/CVE-2020-10672
● CVE — High

CVE-2020-10672

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jms).

View graph Watch Export
CVSS v3.1
8.8 HIGH
EPSS
3.06%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
0
sources referencing this CVE
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionREQUIRED
ScopeUNCHANGED
ConfidentialityHIGH
IntegrityHIGH
AvailabilityHIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Connections
27 relationships
debian linux
source
jackson-databind
source
agile product lifecycle management
source
jd edwards enterpriseone tools
source
financial services analytical applications infrastructure
source
financial services price creation and discovery
source
banking platform
source
steelstore cloud integrated storage
source
communications diameter signaling router
source
communications instant messaging server
source
enterprise manager base platform
source
agile plm
source
communications element manager
source
communications session report manager
source
communications session route manager
source
insurance policy administration j2ee
source
global lifecycle management opatch
source
jd edwards enterpriseone orchestrator
source
banking digital experience
source
communications evolved communications application server
source
communications calendar server
source
communications contacts server
source
communications network charging and control
source
autovue for agile product lifecycle management
source
financial services institutional performance analytics
source
financial services retail customer analytics
source
Timeline
disclosure → media coverage
Mar 18, 2020
Disclosure — published as a CVE record. · last revised by NVD Aug 25, 2026