CVE-2020-35728 is a high-severity deserialization vulnerability affecting FasterXML jackson-databind versions 2.x before 2.9.10.8, specifically impacting its interaction with embedded Xalan within products like Oracle and Debian. With a CVSS score of 8.1, this vulnerability allows unauthenticated attackers to achieve high impact to confidentiality, integrity, and availability with high attack complexity. While the vulnerability has a high EPSS score, indicating potential for exploitation, there is currently no public exploit code, Metasploit modules, or evidence of active exploitation, and it has received minimal community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 2.0.0, < 2.6.7.5CPE matchmatch criteria | cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* | ||
>= 2.7.0, < 2.9.10.8CPE matchmatch criteria | cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* | ||
9.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:a:netapp:service_level_manager:-:*:*:*:*:*:*:* | ||
9.3.6CPE matchmatch criteria | cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.