CVE-2020-10650

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

A deserialization flaw was discovered in jackson-databind through 2.9.10.4. It could allow an unauthenticated user to perform code execution via ignite-jta or quartz-core: org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/FasterXML/jackson-databind/commit/a424c038ba0c0d65e579e22001dec925902ac0efPatch, Third Party Advisory
https://github.com/FasterXML/jackson-databind/issues/2658Patch, Third Party Advisory
https://github.com/advisories/GHSA-rpr3-cw39-3pxhThird Party Advisory
https://lists.debian.org/debian-lts-announce/2023/04/msg00032.htmlThird Party Advisory
https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062Exploit, Third Party Advisory
https://security.netapp.com/advisory/ntap-20230818-0007/Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2022.htmlPatch, Third Party Advisory
https://github.com/FasterXML/jackson-databind/commit/a424c038ba0c0d65e579e22001dec925902ac0efPatch, Third Party Advisory
https://github.com/FasterXML/jackson-databind/issues/2658Patch, Third Party Advisory
https://github.com/advisories/GHSA-rpr3-cw39-3pxhThird Party Advisory
https://lists.debian.org/debian-lts-announce/2023/04/msg00032.htmlThird Party Advisory
https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062Exploit, Third Party Advisory
https://security.netapp.com/advisory/ntap-20230818-0007/Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2022.htmlPatch, Third Party Advisory

Timeline

Published: Dec 26, 2022
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2020

CVE-2020-106549.8Ping Identity PingID SSH before 4.0.14 contains a heap buffer overflow in PingID-enrolled servers. This condition can be potentially exploit CVE-2020-106559.8The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM application ser CVE-2020-106569.8The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM application ser CVE-2020-106577.2The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM web console's I CVE-2020-106589.8The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM application ser CVE-2020-106594.3Entrust Entelligence Security Provider (ESP) before 10.0.60 on Windows mishandles errors during SSL Certificate Validation, leading to situa CVE-2020-10667.8An elevation of privilege vulnerability exists in .NET Framework which could allow an attacker to elevate their privilege level. To exploit CVE-2020-106605.3HashiCorp Vault and Vault Enterprise versions 0.9.0 through 1.3.3 may, under certain circumstances, have an Entity's Group membership inadve CVE-2020-106619.1HashiCorp Vault and Vault Enterprise versions 0.11.0 through 1.3.3 may, under certain circumstances, have existing nested-path policies gran CVE-2020-106637.5The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creat CVE-2020-106647.5The IGMP component in VxWorks 6.8.3 IPNET CVE patches created in 2019 has a NULL Pointer Dereference.CVE-2020-106656.7Docker Desktop allows local privilege escalation to NT AUTHORITY\SYSTEM because it mishandles the collection of diagnostics with Administrat