Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2020-25649

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.

Published

2020-12-03T17:15:12.503

Last Modified

2024-11-21T05:18:20.343

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: PARTIAL
  • Availability Impact: NONE
Exploitability Score

10.0

Impact Score

2.9

Weaknesses
  • Type: Secondary
    CWE-611
  • Type: Primary
    CWE-611
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application fasterxml jackson-databind < 2.6.7.4 Yes
Application fasterxml jackson-databind < 2.9.10.7 Yes
Application fasterxml jackson-databind < 2.10.5.1 Yes
Application netapp oncommand_api_services - Yes
Application netapp oncommand_workflow_automation - Yes
Application netapp service_level_manager - Yes
Operating System fedoraproject fedora 32 Yes
Application quarkus quarkus ≤ 1.6.1 Yes
Application apache iotdb < 0.12.0 Yes
Application oracle agile_plm 9.3.6 Yes
Application oracle agile_product_lifecycle_management_integration_pack 3.6 Yes
Application oracle banking_apis ≤ 18.3 Yes
Application oracle banking_apis 19.1 Yes
Application oracle banking_apis 19.2 Yes
Application oracle banking_apis 20.1 Yes
Application oracle banking_apis 21.1 Yes
Application oracle banking_platform 2.6.2 Yes
Application oracle banking_platform 2.7.0 Yes
Application oracle banking_platform 2.7.1 Yes
Application oracle banking_platform 2.8.0 Yes
Application oracle banking_platform 2.9.0 Yes
Application oracle banking_platform 2.10.0 Yes
Application oracle banking_treasury_management 4.4 Yes
Application oracle blockchain_platform < 21.1.2 Yes
Application oracle coherence 12.2.1.4.0 Yes
Application oracle coherence 14.1.1.0.0 Yes
Application oracle commerce_platform ≤ 11.3.2 Yes
Application oracle commerce_platform 11.2.0 Yes
Application oracle communications_billing_and_revenue_management 7.5.0.23.0 Yes
Application oracle communications_billing_and_revenue_management 12.0.0.3.0 Yes
Application oracle communications_cloud_native_core_unified_data_repository 1.4.0 Yes
Application oracle communications_convergent_charging_controller 12.0.4.0.0 Yes
Application oracle communications_evolved_communications_application_server 7.1 Yes
Application oracle communications_instant_messaging_server 10.0.1.5.0 Yes
Application oracle communications_interactive_session_recorder 6.3 Yes
Application oracle communications_interactive_session_recorder 6.4 Yes
Application oracle communications_network_charging_and_control 12.0.4.0.0 Yes
Application oracle communications_offline_mediation_controller 12.0.0.3 Yes
Application oracle communications_pricing_design_center 12.0.0.4.0 Yes
Application oracle communications_services_gatekeeper 7.0 Yes
Application oracle communications_unified_inventory_management 7.4.1 Yes
Application oracle goldengate_application_adapters 19.1.0.0.0 Yes
Application oracle health_sciences_empirica_signal 9.0 Yes
Application oracle health_sciences_empirica_signal 9.1 Yes
Application oracle insurance_policy_administration ≤ 11.3.0 Yes
Application oracle insurance_policy_administration 11.0.2 Yes
Application oracle insurance_rules_palette ≤ 11.3.0 Yes
Application oracle insurance_rules_palette 11.0.2 Yes
Application oracle jd_edwards_enterpriseone_orchestrator < 9.2.5.3 Yes
Application oracle jd_edwards_enterpriseone_tools < 9.2.5.3 Yes
Application oracle primavera_gateway ≤ 17.12 Yes
Application oracle primavera_gateway ≤ 17.12.11 Yes
Application oracle primavera_gateway ≤ 18.8.11 Yes
Application oracle primavera_gateway ≤ 19.12.10 Yes
Application oracle primavera_gateway 20.12.0 Yes
Application oracle retail_service_backbone 14.1.3.2 Yes
Application oracle retail_service_backbone 15.0.3.1 Yes
Application oracle retail_service_backbone 16.0.3 Yes
Application oracle retail_xstore_point_of_service 16.0.6 Yes
Application oracle retail_xstore_point_of_service 17.0.4 Yes
Application oracle retail_xstore_point_of_service 18.0.3 Yes
Application oracle retail_xstore_point_of_service 19.0.2 Yes
Application oracle retail_xstore_point_of_service 20.0.1 Yes
Application oracle sd-wan_edge 9.0 Yes
Application oracle utilities_framework 4.3.0.5.0 Yes
Application oracle utilities_framework 4.3.0.6.0 Yes
Application oracle utilities_framework 4.4.0.0.0 Yes
Application oracle utilities_framework 4.4.0.2.0 Yes
Application oracle utilities_framework 4.4.0.3.0 Yes
Application oracle webcenter_portal 12.2.1.3.0 Yes
Application oracle webcenter_portal 12.2.1.4.0 Yes
Operating System oracle communications_messaging_server 8.0.2 Yes
Operating System oracle communications_messaging_server 8.1 Yes
References