CVE Feed

    Dashboard / CVE / CVE-2020-14060

    CVE-2020-14060

    FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool (aka apache/drill).

    Published:May 19, 2020
    Last Modified:Aug 25, 2026
    EPS:Jun 14, 2020
    EPSS Score:0.08607
    CVSS Score:8.1

    Affected Products

    Vendor
    Fasterxml
    Product
    Jackson-databind
    Vendor
    Netapp
    Product
    Active Iq Unified Manager
    Vendor
    Netapp
    Product
    Steelstore Cloud Integrated Storage
    Vendor
    Oracle
    Product
    Agile Product Lifecycle Management
    Vendor
    Oracle
    Product
    Banking Digital Experience
    Vendor
    Oracle
    Product
    Communications Calendar Server
    Vendor
    Oracle
    Product
    Communications Contacts Server
    Vendor
    Oracle
    Product
    Communications Diameter Signaling Router
    Vendor
    Oracle
    Product
    Communications Element Manager
    Vendor
    Oracle
    Product
    Communications Evolved Communications Application Server
    Vendor
    Oracle
    Product
    Communications Session Report Manager
    Vendor
    Oracle
    Product
    Communications Session Route Manager
    Vendor
    Redhat
    Product
    Jboss Enterprise Bpms Platform
    Vendor
    Redhat
    Product
    Jboss Enterprise Brms Platform
    Vendor
    Redhat
    Product
    Jboss Fuse
    Vendor
    Redhat
    Product
    Satellite
    Vendor
    Redhat
    Product
    Satellite Capsule

    Exploits

    https://github.com/dawetmaster/CVE-2020-14060-jackson-databind-vulnerable

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-586 Object Injection

    Related CVEs

    CVE-2026-83557 (CVSS 5.6) — DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo …
    CVE-2026-19032 (CVSS 5.3) — jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting t…
    CVE-2026-77310 (CVSS 5.3) — jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Proce…
    CVE-2026-59889 (CVSS 6.5) — jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Proce…
    CVE-2026-59888 (CVSS 6.5) — jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Proce…
    CVE-2026-54518 (CVSS 6.5) — jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Proce…
    CVE-2026-50193 (CVSS 6.3) — jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Proce…
    CVE-2026-54512 (CVSS 8.1) — jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Proce…
    CVE-2026-54513 (CVSS 8.1) — jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Proce…
    CVE-2026-54514 (CVSS 5.3) — jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Proce…

    References

    https://github.com/FasterXML/jackson-databind/issues/2688
    https://lists.debian.org/debian-lts-announce/2020/07/msg00001.html
    https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
    https://security.netapp.com/advisory/ntap-20200702-0003/
    https://www.oracle.com//security-alerts/cpujul2021.html
    https://www.oracle.com/security-alerts/cpuApr2021.html
    https://www.oracle.com/security-alerts/cpujan2021.html
    https://www.oracle.com/security-alerts/cpuoct2020.html
    https://www.oracle.com/security-alerts/cpuoct2021.html
    https://github.com/FasterXML/jackson-databind/issues/2688
    https://lists.debian.org/debian-lts-announce/2020/07/msg00001.html
    https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
    https://security.netapp.com/advisory/ntap-20200702-0003/
    https://www.oracle.com//security-alerts/cpujul2021.html
    https://www.oracle.com/security-alerts/cpuApr2021.html
    https://www.oracle.com/security-alerts/cpujan2021.html
    https://www.oracle.com/security-alerts/cpuoct2020.html
    https://www.oracle.com/security-alerts/cpuoct2021.html

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High