EXPOSURES › CVE-2020-8840

CVE-2020-8840

CRITICAL

DETAIL

SourceNVD · cve Published2020-02-10 CVSS9.8 Referencehttps://nvd.nist.gov/vuln/detail/CVE-2020-8840 ↗

▸ RECOMMENDED ACTION Critical severity — schedule patching of the affected products.

PLAYERS IMPLICATED

NetApp · vendor Oracle · vendor debian · vendor fasterxml · vendor huawei · vendor debian linux · product global lifecycle management opatch · product jackson-databind · product oceanstor 9000 · product oceanstor 9000 firmware · product oncommand api services · product oncommand workflow automation · product service level manager · product steelstore cloud integrated storage · product

DESCRIPTION

FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.

SENTIMENT · TRUSTED SOURCES

synthesis neutral +0.00

No coverage found to assess sentiment.

cooey ↗ neutral +0.00

No coverage found to assess sentiment.

127.0.0.1 ↗ neutral +0.00

No coverage found to assess sentiment.

AFFECTED FEDRAMP PRODUCTS · 11

PRODUCT	PROVIDER	STATUS	MATCH
Aconex for Defense Oracle	Oracle	Authorized	vendor-exact · 0.90
Cloud Insights NetApp	NetApp	In Process	vendor-exact · 0.90
Federal Managed Cloud Services Oracle	Oracle	Authorized	vendor-exact · 0.90
Fusion Cloud Oracle	Oracle	Authorized	vendor-exact · 0.90
Government Cloud - Common Controls Oracle	Oracle	Authorized	vendor-exact · 0.90
Oracle Cloud Infrastructure-Government Cloud Oracle	Oracle	Authorized	vendor-exact · 0.90
Oracle Enterprise Performance Management (EPM) Oracle	Oracle	Authorized	vendor-exact · 0.90
Oracle Enterprise Performance Management (EPM) - Moderate Oracle	Oracle	In Process	vendor-exact · 0.90
Oracle Service Cloud Oracle	Oracle	Authorized	vendor-exact · 0.90
Oracle Service Cloud (DOD) Oracle	Oracle	Authorized	vendor-exact · 0.90
Taleo Cloud - U.S. Government Cloud Oracle	Oracle	Authorized	vendor-exact · 0.90