CVE-2020-14718 — Corporation Graalvm Enterprise Edition vulnerability

5 documents5 sources

Severity

7.2HIGHNVD

OSV9.8

EPSS

1.3%

top 20.11%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Fasterxml Jackson-databind Oracle Corporation Graalvm Enterprise Edition Oracle Graalvm

Timeline

PublishedJul 15

Latest updateMay 24

Description

Vulnerability in the Oracle GraalVM Enterprise Edition product of Oracle GraalVM (component: JVMCI). Supported versions that are affected are 19.3.2 and 20.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle GraalVM Enterprise Edition. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). C…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9

Affected Packages3 packages

▶CVEListV5oracle_corporation/graalvm_enterprise_edition19.3.2, 20.1.0+1

▶NVDoracle/graalvm19.3.2, 20.1.0+1

▶Ubuntufasterxml/jackson-databind< 2.4.2-3ubuntu0.1~esm2

🔴Vulnerability Details

GHSA

GHSA-3q43-4596-jvg6: Vulnerability in the Oracle GraalVM Enterprise Edition product of Oracle GraalVM (component: JVMCI)↗2022-05-24

▶

OSV

jackson-databind vulnerabilities↗2021-03-15

▶

CVEList

CVE-2020-14718: Vulnerability in the Oracle GraalVM Enterprise Edition product of Oracle GraalVM (component: JVMCI)↗2020-07-15

▶

📋Vendor Advisories

Oracle

Oracle Oracle GraalVM Risk Matrix: JVMCI — CVE-2020-14718↗2020-07-15

▶