Vulnerabilities > CVE-2020-35728 - Deserialization of Untrusted Data vulnerability in multiple products

047910
CVSS 8.1 - HIGH
Attack vector
NETWORK
Attack complexity
HIGH
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH

Summary

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).

Vulnerable Configurations

Part Description Count
Application
Fasterxml
27
Application
Netapp
1
Application
Oracle
131
OS
Debian
1

Common Weakness Enumeration (CWE)