Search/CVE-2020-11111
● CVE — High

CVE-2020-11111

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms, activemq-core, activemq-pool, and activemq-pool-jms).

View graph Watch Export
CVSS v3.1
8.8 HIGH
EPSS
3.58%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
0
sources referencing this CVE
EPSS Trend
Aug 16, 2026 → Aug 17, 2026
▲ 0.09pp
3.49% → 3.58% over 2 tracked changes
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionREQUIRED
ScopeUNCHANGED
ConfidentialityHIGH
IntegrityHIGH
AvailabilityHIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Connections
27 relationships
debian linux
source
jackson-databind
source
agile product lifecycle management
source
primavera unifier
source
weblogic server
source
jd edwards enterpriseone tools
source
retail merchandising system
source
banking platform
source
steelstore cloud integrated storage
source
communications diameter signaling router
source
communications instant messaging server
source
retail xstore point of service
source
enterprise manager base platform
source
agile plm
source
communications element manager
source
communications session report manager
source
communications session route manager
source
retail sales audit
source
global lifecycle management opatch
source
jd edwards enterpriseone orchestrator
source
banking digital experience
source
communications evolved communications application server
source
communications calendar server
source
communications contacts server
source
communications network charging and control
source
autovue for agile product lifecycle management
source
Timeline
disclosure → media coverage
Mar 31, 2020
Disclosure — published as a CVE record. · last revised by NVD Aug 25, 2026