CVE-2020-36187

HighCVSS 8.1/10Last modified Oct 8, 2026

Description

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062Exploit, Technical Description, Third Party Advisory
https://github.com/FasterXML/jackson-databind/issues/2997Issue Tracking, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/04/msg00025.htmlMailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20210205-0005/Third Party Advisory
https://www.oracle.com//security-alerts/cpujul2021.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.htmlThird Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.htmlThird Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062Exploit, Technical Description, Third Party Advisory
https://github.com/FasterXML/jackson-databind/issues/2997Issue Tracking, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/04/msg00025.htmlMailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20210205-0005/Third Party Advisory
https://www.oracle.com//security-alerts/cpujul2021.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.htmlThird Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.htmlThird Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory

Timeline

Published: Jan 6, 2021
Last modified: Oct 8, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-361888.1FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.CVE-2020-361898.1FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.CVE-2020-36197.0u'Non-secure memory is touched multiple times during TrustZone\u2019s execution and can lead to privilege escalation or memory corruption' i CVE-2020-361906.1RailsAdmin (aka rails_admin) before 1.4.3 and 2.x before 2.0.2 allows XSS via nested forms.CVE-2020-361914.5JupyterHub 1.1.0 allows CSRF in the admin panel via a request that lacks an _xsrf field, as demonstrated by a /hub/api/user request (to add CVE-2020-361925.3An issue was discovered in the Source Integration plugin before 2.4.1 for MantisBT. An attacker can gain access to the Summary field of priv CVE-2020-361937.5Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a relat CVE-2020-361946.1An XSS vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited, this vulnerability allows attackers to in CVE-2020-361959.8An SQL injection vulnerability has been reported to affect QNAP NAS running Multimedia Console or the Media Streaming add-on. If exploited, CVE-2020-361966.1A stored XSS vulnerability has been reported to affect QNAP NAS running QuLog Center. If exploited, this vulnerability allows attackers to i CVE-2020-361978.8An improper access control vulnerability has been reported to affect earlier versions of Music Station. If exploited, this vulnerability all CVE-2020-361986.7A command injection vulnerability has been reported to affect certain versions of Malware Remover. If exploited, this vulnerability allows r