Is CVE-2020-5411 actively exploited?

No active exploitation of CVE-2020-5411 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2020-5411 be exploited remotely?

Yes. CVE-2020-5411 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2020-5411?

CVE-2020-5411 has a CVSS score of 8.1 (HIGH).

HOME VULNERABILITIESCVE-2020-5411

HIGH

CVE-2020-5411

CWE-502Published: June 11, 2020· Updated: Jun 17, 2026

8.1

CVSS v3.1

Official Description

When configured to enable default typing, Jackson contained a deserialization vulnerability that could lead to arbitrary code execution. Jackson fixed this vulnerability by blacklisting known "deserialization gadgets". Spring Batch configures Jackson with global default typing enabled which means that through the previous exploit, arbitrary code could be executed if all of the following is true: * Spring Batch's Jackson support is being leveraged to serialize a job's ExecutionContext. * A malicious user gains write access to the data store used by the JobRepository (where the data to be deserialized is stored). In order to protect against this type of attack, Jackson prevents a set of untrusted gadget classes from being deserialized. Spring Batch should be proactive against blocking unknown "deserialization gadgets" when enabling default typing.

NVD Source

Technical Analysis

CVE-2020-5411 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 8.1.

From a weakness classification perspective (CWE-502): Insecure deserialization vulnerabilities allow attackers to inject malicious objects during deserialization, potentially enabling remote code execution.