Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2020-25649


A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.


Security Impact Summary

This vulnerability carries a HIGH severity rating with a CVSS v3.1 score of 7.5, indicating it can be exploited remotely over the network with relatively low complexity without requiring user interaction and does not require pre-existing privileges . The vulnerability impacts integrity (unauthorized modifications), for affected systems. Impacting 39 products from fasterxml, from netapp, from netapp and 36 others, organizations running these solutions should prioritize assessment and patching.

Historical Context

Reported in 2020, this vulnerability emerged during an era marked by increased sophistication in supply chain attacks, cloud infrastructure vulnerabilities, and software-as-a-service (SaaS) security challenges. Security practices during this period emphasized zero-trust architectures, container security, and API protection.


Published

2020-12-03T17:15:12.503

Last Modified

2024-11-21T05:18:20.343

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: PARTIAL
  • Availability Impact: NONE
Exploitability Score

10.0

Impact Score

2.9

Weaknesses
  • Type: Secondary
    CWE-611
  • Type: Primary
    CWE-611

Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application fasterxml jackson-databind < 2.6.7.4 Yes
Application fasterxml jackson-databind < 2.9.10.7 Yes
Application fasterxml jackson-databind < 2.10.5.1 Yes
Application netapp oncommand_api_services - Yes
Application netapp oncommand_workflow_automation - Yes
Application netapp service_level_manager - Yes
Operating System fedoraproject fedora 32 Yes
Application quarkus quarkus ≤ 1.6.1 Yes
Application apache iotdb < 0.12.0 Yes
Application oracle agile_plm 9.3.6 Yes
Application oracle agile_product_lifecycle_management_integration_pack 3.6 Yes
Application oracle banking_apis ≤ 18.3 Yes
Application oracle banking_apis 19.1 Yes
Application oracle banking_apis 19.2 Yes
Application oracle banking_apis 20.1 Yes
Application oracle banking_apis 21.1 Yes
Application oracle banking_platform 2.6.2 Yes
Application oracle banking_platform 2.7.0 Yes
Application oracle banking_platform 2.7.1 Yes
Application oracle banking_platform 2.8.0 Yes
Application oracle banking_platform 2.9.0 Yes
Application oracle banking_platform 2.10.0 Yes
Application oracle banking_treasury_management 4.4 Yes
Application oracle blockchain_platform < 21.1.2 Yes
Application oracle coherence 12.2.1.4.0 Yes
Application oracle coherence 14.1.1.0.0 Yes
Application oracle commerce_platform ≤ 11.3.2 Yes
Application oracle commerce_platform 11.2.0 Yes
Application oracle communications_billing_and_revenue_management 7.5.0.23.0 Yes
Application oracle communications_billing_and_revenue_management 12.0.0.3.0 Yes
Application oracle communications_cloud_native_core_unified_data_repository 1.4.0 Yes
Application oracle communications_convergent_charging_controller 12.0.4.0.0 Yes
Application oracle communications_evolved_communications_application_server 7.1 Yes
Application oracle communications_instant_messaging_server 10.0.1.5.0 Yes
Application oracle communications_interactive_session_recorder 6.3 Yes
Application oracle communications_interactive_session_recorder 6.4 Yes
Application oracle communications_network_charging_and_control 12.0.4.0.0 Yes
Application oracle communications_offline_mediation_controller 12.0.0.3 Yes
Application oracle communications_pricing_design_center 12.0.0.4.0 Yes
Application oracle communications_services_gatekeeper 7.0 Yes
Application oracle communications_unified_inventory_management 7.4.1 Yes
Application oracle goldengate_application_adapters 19.1.0.0.0 Yes
Application oracle health_sciences_empirica_signal 9.0 Yes
Application oracle health_sciences_empirica_signal 9.1 Yes
Application oracle insurance_policy_administration ≤ 11.3.0 Yes
Application oracle insurance_policy_administration 11.0.2 Yes
Application oracle insurance_rules_palette ≤ 11.3.0 Yes
Application oracle insurance_rules_palette 11.0.2 Yes
Application oracle jd_edwards_enterpriseone_orchestrator < 9.2.5.3 Yes
Application oracle jd_edwards_enterpriseone_tools < 9.2.5.3 Yes
Application oracle primavera_gateway ≤ 17.12 Yes
Application oracle primavera_gateway ≤ 17.12.11 Yes
Application oracle primavera_gateway ≤ 18.8.11 Yes
Application oracle primavera_gateway ≤ 19.12.10 Yes
Application oracle primavera_gateway 20.12.0 Yes
Application oracle retail_service_backbone 14.1.3.2 Yes
Application oracle retail_service_backbone 15.0.3.1 Yes
Application oracle retail_service_backbone 16.0.3 Yes
Application oracle retail_xstore_point_of_service 16.0.6 Yes
Application oracle retail_xstore_point_of_service 17.0.4 Yes
Application oracle retail_xstore_point_of_service 18.0.3 Yes
Application oracle retail_xstore_point_of_service 19.0.2 Yes
Application oracle retail_xstore_point_of_service 20.0.1 Yes
Application oracle sd-wan_edge 9.0 Yes
Application oracle utilities_framework 4.3.0.5.0 Yes
Application oracle utilities_framework 4.3.0.6.0 Yes
Application oracle utilities_framework 4.4.0.0.0 Yes
Application oracle utilities_framework 4.4.0.2.0 Yes
Application oracle utilities_framework 4.4.0.3.0 Yes
Application oracle webcenter_portal 12.2.1.3.0 Yes
Application oracle webcenter_portal 12.2.1.4.0 Yes
Operating System oracle communications_messaging_server 8.0.2 Yes
Operating System oracle communications_messaging_server 8.1 Yes

References

How SecUtils Interprets This CVE

SecUtils normalizes and enriches National Vulnerability Database (NVD) records by standardizing vendor and product identifiers, aggregating vulnerability metadata from both NVD and MITRE sources, and providing structured context for security teams. For fasterxml's affected products, we extract Common Platform Enumeration (CPE) data, Common Weakness Enumeration (CWE) classifications, CVSS severity metrics, and reference data to enable rapid vulnerability prioritization and asset correlation. This record contains no exploit code, proof-of-concept instructions, or attack methodologies—only defensive intelligence necessary for patch management, risk assessment, and security operations.