CVE-2020-35491

What this means for your business

• It affects Fasterxml Jackson-Databind. It matters if your company, or a supplier that handles your data, runs it.
• Code showing how to exploit it has been published, but real attacks have not been confirmed.
• An attacker can use it remotely, over a network, without a login, and without anyone at your company clicking anything.
• FIRST's prediction model gives it a 10% chance of attack attempts being seen in the next 30 days, ranking above 95% of all known flaws.

What to do

1. 1Check whether your company or your suppliers run Fasterxml Jackson-Databind, and which version. The affected versions are listed further down this page.
2. 2If you do, apply the vendor's fix. A patch or vendor advisory has been published.