CVE-2020-8840
criticalFasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.
Vendor / product: Fasterxml — jackson-databind
FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.
CVSS
9.8
9.8 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2020-02-10 21:56
Modified: 2026-10-08 21:17
NVD status: Modified
Last synced 2 days ago
Verified against the source API 2026-10-27 07:06 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
fasterxml / jackson-databind ≥2.0.0 <2.7.9.7, ≥2.8.0 <2.8.11.5, ≥2.9.0 <2.9.10.3
debian / debian_linux 8.0
netapp / oncommand_api_services all versions
netapp / oncommand_workflow_automation all versions
netapp / service_level_manager all versions
netapp / steelstore_cloud_integrated_storage all versions
huawei / oceanstor_9000_firmware v300r006c20, v300r006c20spc100, v300r006c20spc200, v300r006c20spc300
oracle / global_lifecycle_management_opatch <11.2.0.3.23, ≥12.2.0.1.0 <12.2.0.1.19, ≥13.9.4.0.0 <13.9.4.2.1
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200610-01-fastjason-en cve@mitre.org
- https://github.com/FasterXML/jackson-databind/issues/2620 cve@mitre.org
- https://lists.apache.org/thread.html/r078e68a926ea6be12e8404e47f45aabf04bb4668e8265c0de41d... cve@mitre.org
- https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e8... cve@mitre.org
- https://lists.apache.org/thread.html/r1c09b9551f6953dbeca190a4c4b78198cdbb9825fce36f96fe3d... cve@mitre.org
- https://lists.apache.org/thread.html/r1efc776fc6ce3387593deaa94bbdd296733b1b01408a39c8d1ab... cve@mitre.org
- https://lists.apache.org/thread.html/r2fa8046bd47fb407ca09b5107a80fa6147ba4ebe879caae5c98b... cve@mitre.org
- https://lists.apache.org/thread.html/r319f19c74e06c201b9d4e8b282a4e4b2da6dcda022fb46f007dd... cve@mitre.org
- https://lists.apache.org/thread.html/r3539bd3a377991217d724879d239e16e86001c54160076408574... cve@mitre.org
- https://lists.apache.org/thread.html/r3d20a2660b36551fd8257d479941782af4a7169582449fac1704... cve@mitre.org
- https://lists.apache.org/thread.html/r428d068b2a4923f1a5a4f5fc6381b95205cfe7620169d16db78e... cve@mitre.org
- https://lists.apache.org/thread.html/r446646c5588b10f5e02409ad580b12f314869009cdfbf844ca39... cve@mitre.org
- https://lists.apache.org/thread.html/r46bebdeb59b8b7212d63a010ca445a9f5c4e9d64dcf693cab6f3... cve@mitre.org
- https://lists.apache.org/thread.html/r5d8bea8e9d17b6efcf4a0e4e194e91ef46a99f505777a31a60da... cve@mitre.org
- https://lists.apache.org/thread.html/r65ee95fa09c831843bac81eaa582fdddc2b6119912a72d1c83a9... cve@mitre.org
- https://lists.apache.org/thread.html/r6fdd4c61a09a0c89f581b4ddb3dc6f154ab0c705fcfd0a7358b2... cve@mitre.org
- https://lists.apache.org/thread.html/r7762d69e85c58d6948823424017ef4c08f47de077644277fa18c... cve@mitre.org
- https://lists.apache.org/thread.html/r7e5c10534ed06bf805473ac85e8412fe3908a8fa4cabf5027bf1... cve@mitre.org
- https://lists.apache.org/thread.html/r8170007fd9b263d65b37d92a7b5d7bc357aedbb113a32838bc4a... cve@mitre.org
- https://lists.apache.org/thread.html/r8e96c340004b7898cad3204ea51280ef6e4b553a684e1452bf1b... cve@mitre.org
- https://lists.apache.org/thread.html/r94930e39b60fff236160c1c4110fe884dc093044b067aa5fc98d... cve@mitre.org
- https://lists.apache.org/thread.html/r9e59ebaf76fd00b2fa3ff5ebf18fe075ca9f4376216612c696f7... cve@mitre.org
- https://lists.apache.org/thread.html/r9ecf211c22760b00967ebe158c6ed7dba9142078e2a630ab8904... cve@mitre.org
- https://lists.apache.org/thread.html/ra275f29615f35d5b40106d1582a41e5388b2a5131564e9e01a57... cve@mitre.org
- https://lists.apache.org/thread.html/rac5ee5d686818be7e7c430d35108ee01a88aae54f832d32f6243... cve@mitre.org
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 07:06 UTC · record ↗