CVE-2020-36179

HIGH

Oracle JD Edwards Enterpriseone Tools - Insecure Deserialization

Title source: rule

Exploitation Summary

EIP tracks 3 public exploits for CVE-2020-36179. PoCs published by Al1ex, dawetmaster, andikahilmy.

AI-analyzed exploit summary This repository provides a functional exploit PoC for CVE-2020-36180, demonstrating RCE via Jackson deserialization gadgets targeting `org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS`. The PoC includes a Maven project with dependencies, a malicious SQL script, and Java code to trigger the vulnerability.

Description

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS.

Exploits (3)

nomisec WORKING POC 81 stars

by Al1ex · poc

https://github.com/Al1ex/CVE-2020-36179

View Code ZIP pw:eip

This repository provides a functional exploit PoC for CVE-2020-36180, demonstrating RCE via Jackson deserialization gadgets targeting `org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS`. The PoC includes a Maven project with dependencies, a malicious SQL script, and Java code to trigger the vulnerability.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: FasterXML jackson-databind 2.x before 2.9.10.8

No auth needed

Prerequisites: Vulnerable version of jackson-databind · Presence of commons-dbcp2 dependency · Network access to host malicious SQL script

MITRE ATT&CK

T1189 - Drive-by Compromise T1203 - Exploitation for Client Execution

devstral-2 · analyzed Feb 18, 2026 Full analysis →

nomisec WORKING POC

by dawetmaster · poc

https://github.com/dawetmaster/CVE-2020-36179-jackson-databind-vulnerable

View Code ZIP pw:eip

This repository contains a vulnerable version of Jackson Databind (2.9.0) that is susceptible to CVE-2020-36179, a deserialization vulnerability. The included source code and build configuration allow for testing and exploitation of the vulnerability.

Classification

Working Poc 90%

Attack Type

Deserialization

Complexity

Moderate

Reliability

Reliable

Target: Jackson Databind 2.9.0

No auth needed

Prerequisites: Java environment · Jackson Databind 2.9.0

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter

devstral-2 · analyzed Mar 14, 2026 Full analysis →

nomisec WORKING POC

by andikahilmy · poc

https://github.com/andikahilmy/CVE-2020-36179-jackson-databind-vulnerable

View Code ZIP pw:eip

This repository contains a functional exploit for CVE-2020-36179, a deserialization vulnerability in Jackson Databind. The PoC includes Java source code demonstrating the vulnerability, along with build and execution scripts.

Classification

Working Poc 90%

Attack Type

Deserialization

Complexity

Moderate

Reliability

Reliable

Target: Jackson Databind (versions affected by CVE-2020-36179)

No auth needed

Prerequisites: Vulnerable version of Jackson Databind · Ability to send crafted JSON payloads to the target application

MITRE ATT&CK