CVE-2020-10650

CVE Enrichment

CVSS: 8.1 HIGH
EPSS: 3.47%
EPSS Percentile: 88.79%
CISA KEV: Not listed

Description

A deserialization flaw was discovered in jackson-databind through 2.9.10.4. It could allow an unauthenticated user to perform code execution via ignite-jta or quartz-core: org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: cve@mitre.org
Published: 27-Dec-2022 03:15
Last Modified: 17-Jun-2026 09:48
EPSS Date: 2026-10-12
CWE: CWE-502

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:H /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

Affected Products / Versions

debian / debian_linux
Version / affected range: 10.0
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
netapp / active_iq_unified_manager
Version / affected range: -
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*
netapp / active_iq_unified_manager
Version / affected range: -
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
netapp / active_iq_unified_manager
Version / affected range: -
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*
fasterxml / jackson-databind
Version / affected range: * · before (exclusive) 2.9.10.4
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*
fasterxml / jackson-databind
Version / affected range: 2.10.0
cpe:2.3:a:fasterxml:jackson-databind:2.10.0:prerelease1:*:*:*:*:*:*
fasterxml / jackson-databind
Version / affected range: 2.10.0
cpe:2.3:a:fasterxml:jackson-databind:2.10.0:prerelease2:*:*:*:*:*:*
fasterxml / jackson-databind
Version / affected range: 2.10.0
cpe:2.3:a:fasterxml:jackson-databind:2.10.0:prerelease3:*:*:*:*:*:*
oracle / retail_merchandising_system
Version / affected range: 15.0
cpe:2.3:a:oracle:retail_merchandising_system:15.0:*:*:*:*:*:*:*
oracle / retail_sales_audit
Version / affected range: 14.1
cpe:2.3:a:oracle:retail_sales_audit:14.1:*:*:*:*:*:*:*

References

Last enrichment sync: 13-Oct-2026 18:39
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

CVE-2020-10650: JNDI Injection, Remote Code Execution Androxgh0st Uses UC San Diego-Linked Subdomain to Host C2 Logger, CloudSEK Reports

CVE (7)

Malware (1)

Threat Actors (1)

MITRE ATT&CK (4)

Vendors (1)

Products (8)

Tools (1)

Industries (1)

Countries (2)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.