CVE-2020-10650

HIGH

jackson-databind vulnerable to unsafe deserialization

Title source: GitHub Advisory
STIX 2.1 vulnerability

Record summary

CVE-2020-10650 has a selected CVSS score of 8.1 (high).

Description

A deserialization flaw was discovered in jackson-databind through 2.9.10.4. It could allow an unauthenticated user to perform code execution via ignite-jta or quartz-core: org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jun 23, 2025 · VulnCheck
Reported exploitation
Observed · VulnCheck

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 14, 2025 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

debian_linux

Browse debian / debian_linux
VulnCheckVersion data not supplied

com.fasterxml.jackson.core:jackson-databind

Browse Maven / com.fasterxml.jackson.core:jackson-databind
GitHub AdvisoryBefore 2.9.10.4 · Fixed in 2.9.10.4affected

References

Showing 12 of 13