CVE-2020-8840

Published Feb 10, 2020

Last updated a year ago

Overview

Description: FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.
Source: cve@mitre.org
NVD status: Modified

Hype score: Not currently trending

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

CVSS 2.0

Type: Primary
Base score: 7.5
Impact score: 6.4
Exploitability score: 10
Vector string: AV:N/AC:L/Au:N/C:P/I:P/A:P

Weaknesses

nvd@nist.gov: CWE-502

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2F87CF67-6994-43F1-BEC3-DD7D122D0146",
            "versionEndExcluding": "2.7.9.7",
            "versionStartIncluding": "2.0.0"
          },
          {
            "criteria": "cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "BF323F3D-B2A4-41E7-94F9-5539C9B7025E",
            "versionEndExcluding": "2.8.11.5",
            "versionStartIncluding": "2.8.0"
          },
          {
            "criteria": "cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "4B316C68-EEEF-436D-9570-907CAC8F0507",
            "versionEndExcluding": "2.9.10.3",
            "versionStartIncluding": "2.9.0"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:netapp:oncommand_api_services:-:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "5EC98B22-FFAA-4B59-8E63-EBAA4336AD13"
          },
          {
            "criteria": "cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "5735E553-9731-4AAC-BCFF-989377F817B3"
          },
          {
            "criteria": "cpe:2.3:a:netapp:service_level_manager:-:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7081652A-D28B-494E-94EF-CA88117F23EE"
          },
          {
            "criteria": "cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E94F7F59-1785-493F-91A7-5F5EA5E87E4D"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:huawei:oceanstor_9000_firmware:v300r006c20:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "99FB89BE-A430-4540-B1B5-5F8458E79AF2"
          },
          {
            "criteria": "cpe:2.3:o:huawei:oceanstor_9000_firmware:v300r006c20spc100:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "0AA58161-B5CA-44CE-B16B-A09D86CB7A9E"
          },
          {
            "criteria": "cpe:2.3:o:huawei:oceanstor_9000_firmware:v300r006c20spc200:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "DBC5C81D-495A-432B-A3A8-B208BB2270F2"
          },
          {
            "criteria": "cpe:2.3:o:huawei:oceanstor_9000_firmware:v300r006c20spc300:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "066EEFAA-917D-40BF-8D92-AE8CBEC0312D"
          }
        ],
        "operator": "OR"
      },
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:h:huawei:oceanstor_9000:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "AEC54023-CF84-4095-A3E8-2D6E334768E9"
          }
        ],
        "operator": "OR"
      }
    ],
    "operator": "AND"
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:oracle:global_lifecycle_management_opatch:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F6455EB1-C741-45E8-A53E-E7AD7A5D00EE",
            "versionEndExcluding": "11.2.0.3.23"
          },
          {
            "criteria": "cpe:2.3:a:oracle:global_lifecycle_management_opatch:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "BFD43191-E67F-4D1B-967B-3C7B20331945",
            "versionEndExcluding": "12.2.0.1.19",
            "versionStartIncluding": "12.2.0.1.0"
          },
          {
            "criteria": "cpe:2.3:a:oracle:global_lifecycle_management_opatch:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "062C588A-CBBA-470F-8D11-2F961922E927",
            "versionEndExcluding": "13.9.4.2.1",
            "versionStartIncluding": "13.9.4.0.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 3.1

CVSS 2.0

Weaknesses

Configurations

References