CVE-2021-20190
HIGHFasterxml Jackson-databind < 2.6.7.5 - Insecure Deserialization
Title source: ruleDescription
A flaw was found in jackson-databind before 2.9.10.7. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Exploits (2)
nomisec
WORKING POC
by dawetmaster · poc
https://github.com/dawetmaster/CVE-2021-20190-jackson-databind-vulnerable
nomisec
WORKING POC
by andikahilmy · poc
https://github.com/andikahilmy/CVE-2021-20190-jackson-databind-vulnerable
References (6)
Scores
CVSS v3
8.1
EPSS
0.0050
EPSS Percentile
66.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-502
Status
published
Products (9)
apache/nifi
1.7.0 - 1.12.1
com.fasterxml.jackson.core/jackson-databind
2.7.0 - 2.9.10.7Maven
debian/debian_linux
9.0
fasterxml/jackson-databind
< 2.6.7.5
netapp/active_iq_unified_manager
(2 CPE variants)
netapp/oncommand_api_services
netapp/oncommand_insight
netapp/service_level_manager
oracle/commerce_guided_search_and_experience_manager
11.3.2
Published
Jan 19, 2021
Tracked Since
Feb 18, 2026