Search/CVE-2020-36180
● CVE — High

CVE-2020-36180

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS.

View graph Watch Export
CVSS v3.1
8.1 HIGH
EPSS
5.04%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
0
sources referencing this CVE
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityHIGH
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
ConfidentialityHIGH
IntegrityHIGH
AvailabilityHIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Connections
27 relationships
debian linux
source
cloud backup
source
agile product lifecycle management
source
communications billing and revenue management
source
communications instant messaging server
source
communications diameter signaling route
source
service level manager
source
application testing suite
source
communications policy management
source
agile plm
source
communications element manager
source
banking corporate lending process management
source
banking credit facilities process management
source
banking supply chain finance
source
banking virtual account management
source
commerce platform
source
banking extensibility workbench
source
blockchain platform
source
communications cloud native core policy
source
communications cloud native core unified data repository
source
communications evolved communications application server
source
communications network charging and control
source
autovue for agile product lifecycle management
source
communications offline mediation controller
source
banking treasury management
source
communications convergent charging controller
source
Timeline
disclosure → media coverage
Jan 7, 2021
Disclosure — published as a CVE record. · last revised by NVD Aug 25, 2026
Public PoC (1)
github.com/cuijiung/jackson-CVE-2020-36180
Unverified third-party code — review before executing.