| Vulnerability Name: | CVE-2020-8840 (CCN-176241) | ||||||||||||||||||
| Assigned: | 2020-02-09 | ||||||||||||||||||
| Published: | 2020-02-09 | ||||||||||||||||||
| Updated: | 2023-06-08 | ||||||||||||||||||
| Summary: | An unspecified error with the lack of certain xbean-reflect/JNDI blocking in FasterXML jackson-databind has an unknown impact and attack vector. | ||||||||||||||||||
| CVSS v3 Severity: | 9.8 Critical (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) 8.5 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
4.6 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C)
7.1 High (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
| ||||||||||||||||||
| CVSS v2 Severity: | 7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
| ||||||||||||||||||
| Vulnerability Consequences: | Gain Access | ||||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2020-8840 Source: cve@mitre.org Type: Third Party Advisory cve@mitre.org Source: XF Type: UNKNOWN fasterxml-ve20208840-unspecified(176241) Source: CCN Type: jackson-databind GIT Repository Block one more gadget type (xbean-reflect/JNDI - CVE-2020-8840) #2620 Source: cve@mitre.org Type: Third Party Advisory cve@mitre.org Source: cve@mitre.org Type: Mailing List, Third Party Advisory cve@mitre.org Source: cve@mitre.org Type: Mailing List, Third Party Advisory cve@mitre.org Source: cve@mitre.org Type: Mailing List, Third Party Advisory cve@mitre.org Source: cve@mitre.org Type: Mailing List, Third Party Advisory cve@mitre.org Source: cve@mitre.org Type: Mailing List, Third Party Advisory cve@mitre.org Source: cve@mitre.org Type: Mailing List, Third Party Advisory cve@mitre.org Source: cve@mitre.org Type: Mailing List, Third Party Advisory cve@mitre.org Source: cve@mitre.org Type: Mailing List, Third Party Advisory cve@mitre.org Source: cve@mitre.org Type: Mailing List, Third Party Advisory cve@mitre.org Source: cve@mitre.org Type: Mailing List, Third Party Advisory cve@mitre.org Source: cve@mitre.org Type: Mailing List, Third Party Advisory cve@mitre.org Source: cve@mitre.org Type: Mailing List, Third Party Advisory cve@mitre.org Source: cve@mitre.org Type: Mailing List, Third Party Advisory cve@mitre.org Source: cve@mitre.org Type: Mailing List, Third Party Advisory cve@mitre.org Source: cve@mitre.org Type: Mailing List, Third Party Advisory cve@mitre.org Source: cve@mitre.org Type: Mailing List, Third Party Advisory cve@mitre.org Source: cve@mitre.org Type: Mailing List, Third Party Advisory cve@mitre.org Source: cve@mitre.org Type: Mailing List, Third Party Advisory cve@mitre.org Source: cve@mitre.org Type: Mailing List, Third Party Advisory cve@mitre.org Source: cve@mitre.org Type: Mailing List, Third Party Advisory cve@mitre.org Source: cve@mitre.org Type: Mailing List, Third Party Advisory cve@mitre.org Source: cve@mitre.org Type: Mailing List, Third Party Advisory cve@mitre.org Source: cve@mitre.org Type: Mailing List, Third Party Advisory cve@mitre.org Source: cve@mitre.org Type: Mailing List, Third Party Advisory cve@mitre.org Source: cve@mitre.org Type: Mailing List, Third Party Advisory cve@mitre.org Source: cve@mitre.org Type: Mailing List, Third Party Advisory cve@mitre.org Source: cve@mitre.org Type: Mailing List, Third Party Advisory cve@mitre.org Source: cve@mitre.org Type: Mailing List, Third Party Advisory cve@mitre.org Source: cve@mitre.org Type: Mailing List, Third Party Advisory cve@mitre.org Source: cve@mitre.org Type: Mailing List, Third Party Advisory cve@mitre.org Source: cve@mitre.org Type: Mailing List, Third Party Advisory cve@mitre.org Source: cve@mitre.org Type: Mailing List, Third Party Advisory cve@mitre.org Source: cve@mitre.org Type: Mailing List, Third Party Advisory cve@mitre.org Source: cve@mitre.org Type: Mailing List, Third Party Advisory cve@mitre.org Source: cve@mitre.org Type: Mailing List, Third Party Advisory cve@mitre.org Source: cve@mitre.org Type: Mailing List, Third Party Advisory cve@mitre.org Source: cve@mitre.org Type: Mailing List, Third Party Advisory cve@mitre.org Source: cve@mitre.org Type: Mailing List, Third Party Advisory cve@mitre.org Source: cve@mitre.org Type: Mailing List, Third Party Advisory cve@mitre.org Source: cve@mitre.org Type: Third Party Advisory cve@mitre.org Source: CCN Type: IBM Security Bulletin 6172383 (Cloud Pak System) Vulnerability in Open Source Jackson databind used in IBM Cloud Pak System (CVE-2020-8840) Source: CCN Type: IBM Security Bulletin 6208043 (Sterling B2B Integrator) Multiple Security Vulnerabilities in Jackson-databind Affect IBM Sterling B2B Integrator Source: CCN Type: IBM Security Bulletin 6209044 (Global High Availability Mailbox) Multiple security vulnerabilities have been Identified In Jackson Databind library shipped with IBM Global Mailbox Source: CCN Type: IBM Security Bulletin 6214472 (Planning Analytics Local) IBM Planning Analytics Workspace is affected by security vulnerabilities Source: CCN Type: IBM Security Bulletin 6217634 (Watson Developer Cloud) Potential vulnerability with FasterXML jackson-databind Source: CCN Type: IBM Security Bulletin 6221336 (Spectrum Protect Plus) Vulnerabilities in FasterXML jackson-databind affect IBM Spectrum Protect Plus (CVE-2020-9548, CVE-2020-9546. CVE-2020-9547, CVE-2020-8840, CVE-2019-20330) Source: CCN Type: IBM Security Bulletin 6226394 (Event Streams) IBM Event Streams is affected by jackson-databind vulnerability CVE-2020-8840 Source: CCN Type: IBM Security Bulletin 6228078 (Watson Discovery) IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in FasterXML jackson-databind Source: CCN Type: IBM Security Bulletin 6243446 (Data Risk Manager) IBM Data Risk Manager is affected by multiple vulnerabilities Source: CCN Type: IBM Security Bulletin 6250409 (Operations Analytics Predictive Insights) A vulnerability in Jackson Databind affects IBM Operations Analytics Predictive Insights (CVE-2020-8840) Source: CCN Type: IBM Security Bulletin 6259479 (Network Performance Insight) jackson-databind (Publicly disclosed vulnerability) found in Network Performance Insight (CVE-2020-8840) Source: CCN Type: IBM Security Bulletin 6343287 (Security Guardium) IBM Security Guardium is affected by a jackson-databind vulnerability Source: CCN Type: IBM Security Bulletin 6597241 (Cognos Analytics) IBM Cognos Analytics has addressed multiple vulnerabilities Source: cve@mitre.org Type: Third Party Advisory cve@mitre.org Source: cve@mitre.org Type: Third Party Advisory cve@mitre.org | ||||||||||||||||||
| Vulnerable Configuration: | Configuration RedHat 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||||||||
| Oval Definitions | |||||||||||||||||||
| |||||||||||||||||||
| BACK | |||||||||||||||||||