VYPR
← All advisories
High severityNVD Advisory· Published Dec 26, 2022· Updated Apr 14, 2025

CVE-2020-10650

CVE-2020-10650

Description

A deserialization flaw was discovered in jackson-databind through 2.9.10.4. It could allow an unauthenticated user to perform code execution via ignite-jta or quartz-core: org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A deserialization vulnerability in jackson-databind before 2.9.10.5 allows unauthenticated remote code execution via ignite-jta or quartz-core gadgets.

Vulnerability

Description

CVE-2020-10650 is a deserialization flaw in FasterXML jackson-databind through version 2.9.10.4. The root cause is the unsafe deserialization of polymorphic types, which can be exploited when the application enables default typing or uses @JsonTypeInfo with JsonTypeInfo.Id.CLASS or JsonTypeInfo.Id.MINIMAL_CLASS. This allows an attacker to instantiate arbitrary classes from the classpath, leading to remote code execution [2].

Exploitation

An unauthenticated attacker can trigger the vulnerability by sending a crafted JSON payload that references specific gadget classes from the ignite-jta or quartz-core libraries. The identified gadget chains are org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider [3]. No authentication is required, and the attack can be performed over the network if the application deserializes untrusted JSON data.

Impact

Successful exploitation allows an attacker to execute arbitrary code on the server with the privileges of the application process. This can lead to full compromise of the affected system, including data theft, service disruption, or lateral movement within the network [2].

Mitigation

The vulnerability is fixed in jackson-databind version 2.9.10.5 and later. Users should upgrade to a patched version immediately. For those unable to upgrade, backports have been made available for older branches, including 2.6.x, as demonstrated in pull request #2864 [4]. Additionally, disabling default typing or restricting allowed deserialization classes can serve as a workaround.

References
  1. NVD - CVE-2020-10650
  2. Block one more gadget type (ignite-jta, CVE-2020-10650)
  3. (2.6) Backport all CVE fixes up to 2.9.10.6 by millems · Pull Request #2864 · FasterXML/jackson-databind

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
com.fasterxml.jackson.core:jackson-databindMaven
< 2.9.10.42.9.10.4

Affected products

2

Patches

1
a424c038ba0c

Fix #2658

https://github.com/FasterXML/jackson-databindTatu SalorantaMar 16, 2020via ghsa
commit
2 files changed · +6 −0
  • release-notes/VERSION-2.x+1 −0 modified
    @@ -14,6 +14,7 @@ Project: jackson-databind
  (reported by threedr3am)
 #2648: Block one more gadget type (shiro-core)
 #2653: Block one more gadget type (shiro-core)
+#2658: Block one more gadget type (ignite-jta)
 
 2.9.10.3 (23-Feb-2020)
  • src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java+5 −0 modified
    @@ -142,6 +142,11 @@ public class SubTypeValidator
         s.add("org.apache.shiro.realm.jndi.JndiRealmFactory");
         s.add("org.apache.shiro.jndi.JndiObjectFactory");
 
+        // [databind#2658]: ignite-jta (, quartz-core)
+        s.add("org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup");
+        s.add("org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory");
+        s.add("org.quartz.utils.JNDIConnectionProvider");
+
         DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
     }

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

13

News mentions

0

No linked articles in our index yet.