CVE
CVE-2020-9547
- First Reported
- Jun 22, 2025
- Latest Reported
- Jun 22, 2025
CVE Enrichment
- CVSS
- 9.8 CRITICAL
- EPSS
- 18.38%
- EPSS Percentile
- 97.17%
- CISA KEV
- Not listed
Description
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).
Technical Details
- CVSS Version
- 3.1
- CNA / NVD Source
- cve@mitre.org
- Published
- 02-Mar-2020 11:15
- Last Modified
- 08-Oct-2026 05:16
- EPSS Date
- 2026-10-12
- CWE
- CWE-502
CVSS Vector
CVSS:3.1 AV:N /
AC:L /
PR:N /
UI:N /
S:U /
C:H /
I:H /
A:H
Affected Products / Versions
- fasterxml / jackson-databind
Version / affected range: * · from (inclusive) 2.0.0 · before (exclusive) 2.7.9.7
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* - fasterxml / jackson-databind
Version / affected range: * · from (inclusive) 2.8.0 · before (exclusive) 2.8.11.6
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* - fasterxml / jackson-databind
Version / affected range: * · from (inclusive) 2.9.0 · before (exclusive) 2.9.10.4
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* - netapp / active_iq_unified_manager
Version / affected range: * · from (inclusive) 7.3
cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:linux:*:* - netapp / active_iq_unified_manager
Version / affected range: * · from (inclusive) 7.3
cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:* - netapp / active_iq_unified_manager
Version / affected range: * · from (inclusive) 9.5
cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:* - debian / debian_linux
Version / affected range: 8.0
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* - oracle / autovue_for_agile_product_lifecycle_management
Version / affected range: 21.0.2
cpe:2.3:a:oracle:autovue_for_agile_product_lifecycle_management:21.0.2:*:*:*:*:*:*:* - oracle / banking_platform
Version / affected range: * · from (inclusive) 2.4.0 · through (inclusive) 2.9.0
cpe:2.3:a:oracle:banking_platform:*:*:*:*:*:*:*:* - oracle / communications_contacts_server
Version / affected range: 8.0.0.4.0
cpe:2.3:a:oracle:communications_contacts_server:8.0.0.4.0:*:*:*:*:*:*:* - oracle / communications_evolved_communications_application_server
Version / affected range: 7.1
cpe:2.3:a:oracle:communications_evolved_communications_application_server:7.1:*:*:*:*:*:*:* - oracle / communications_instant_messaging_server
Version / affected range: 10.0.1.4.0
cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.4.0:*:*:*:*:*:*:* - oracle / communications_network_charging_and_control
Version / affected range: * · from (inclusive) 12.0.0 · through (inclusive) 12.0.3
cpe:2.3:a:oracle:communications_network_charging_and_control:*:*:*:*:*:*:*:* - oracle / communications_network_charging_and_control
Version / affected range: 6.0.1
cpe:2.3:a:oracle:communications_network_charging_and_control:6.0.1:*:*:*:*:*:*:* - oracle / enterprise_manager_base_platform
Version / affected range: 13.3.0.0
cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3.0.0:*:*:*:*:*:*:* - oracle / enterprise_manager_base_platform
Version / affected range: 13.4.0.0
cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:* - oracle / global_lifecycle_management_opatch
Version / affected range: * · before (exclusive) 12.2.0.1.20
cpe:2.3:a:oracle:global_lifecycle_management_opatch:*:*:*:*:*:*:*:* - oracle / jd_edwards_enterpriseone_orchestrator
Version / affected range: * · before (exclusive) 9.2.4.2
cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:*:*:*:*:*:*:*:* - oracle / jd_edwards_enterpriseone_tools
Version / affected range: * · before (exclusive) 9.2.4.2
cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:* - oracle / primavera_unifier
Version / affected range: * · from (inclusive) 17.7 · through (inclusive) 17.12
cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:* - oracle / primavera_unifier
Version / affected range: 16.1
cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:* - oracle / primavera_unifier
Version / affected range: 16.2
cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:* - oracle / primavera_unifier
Version / affected range: 18.8
cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:* - oracle / primavera_unifier
Version / affected range: 19.12
cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:* - oracle / retail_xstore_point_of_service
Version / affected range: 15.0
cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0:*:*:*:*:*:*:* - oracle / retail_xstore_point_of_service
Version / affected range: 16.0
cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0:*:*:*:*:*:*:* - oracle / retail_xstore_point_of_service
Version / affected range: 17.0
cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:*:*:*:*:*:*:* - oracle / retail_xstore_point_of_service
Version / affected range: 18.0
cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0:*:*:*:*:*:*:* - oracle / retail_xstore_point_of_service
Version / affected range: 19.0
cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0:*:*:*:*:*:*:* - oracle / weblogic_server
Version / affected range: 12.2.1.3.0
cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:* - oracle / weblogic_server
Version / affected range: 12.2.1.4.0
cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*
References
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.
Reported Context (1)
- CVE-2020-9547: JNDI Injection, Remote Code Execution Androxgh0st Uses UC San Diego-Linked Subdomain to Host C2 Logger, CloudSEK Reports
CVE (7)
Malware (1)
Threat Actors (1)
MITRE ATT&CK (4)
Vendors (1)
Products (8)
Tools (1)
Industries (1)
Countries (2)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.