High severity · published Dec 3, 2020
CVE-2020-25649
A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly
7.5
CVSS
17.7%
EPSS
No
On KEV
Description
A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)17.7% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JA
jackson-databind ·
jackson-databind-2.11.0 · source: vendor, NVD
AP
Agile Product Lifecycle Management · Oracle
9.3.6 · source: NVD
AP
Agile Product Lifecycle Management Integration Pack · Oracle
3.6 · source: NVD
BA
Banking Apis · Oracle
18.1 through 18.3; 19.1; 19.2; 20.1; 21.1 · source: NVD
BP
Banking Platform · Oracle
2.6.2; 2.7.0; 2.7.1; 2.8.0; 2.9.0; 2.10.0 · source: NVD
BT
Banking Treasury Management · Oracle
4.4 · source: NVD
BP
Blockchain Platform · Oracle
before 21.1.2 · source: NVD
CO
Coherence · Oracle
12.2.1.4.0; 14.1.1.0.0 · source: NVD
CP
Commerce Platform · Oracle
11.3.0 through 11.3.2; 11.2.0 · source: NVD
CB
Communications Billing And Revenue Management · Oracle
7.5.0.23.0; 12.0.0.3.0 · source: NVD
CC
Communications Cloud Native Core Unified Data Repository · Oracle
1.4.0 · source: NVD
CC
Communications Convergent Charging Controller · Oracle
12.0.4.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-25649
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-25649
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1887664
Patch
https://github.com/FasterXML/jackson-databind/issues/2589
lists.apache.org
https://lists.apache.org/thread.html/r011d1430e8f40dff9550c3bc5d0f48b14c01ba8aecabd91d5e495386%40%3Ccommits.turbine.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r024b7bda9c43c5560d81238748775c5ecfe01b57280f90df1f773949%40%3Cissues.hive.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r04529cedaca40c2ff90af4880493f9c88a8ebf4d1d6c861d23108a5a%40%3Cnotifications.zookeeper.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r0881e23bd9034c8f51fdccdc8f4d085ba985dcd738f8520569ca5c3d%40%3Cissues.hive.apache.org%3E