A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
Configuration 5 (hide)
|
Configuration 6 (hide)
|
History
No history.
Information
Published : 2020-12-03 17:15
Updated : 2023-11-07 03:20
NVD link : CVE-2020-25649
Mitre link : CVE-2020-25649
CVE.ORG link : CVE-2020-25649
JSON object : View
Products Affected
oracle
- communications_offline_mediation_controller
- communications_cloud_native_core_unified_data_repository
- communications_convergent_charging_controller
- agile_plm
- communications_network_charging_and_control
- communications_evolved_communications_application_server
- banking_apis
- communications_unified_inventory_management
- insurance_rules_palette
- retail_xstore_point_of_service
- webcenter_portal
- jd_edwards_enterpriseone_tools
- sd-wan_edge
- insurance_policy_administration
- communications_billing_and_revenue_management
- banking_platform
- jd_edwards_enterpriseone_orchestrator
- agile_product_lifecycle_management_integration_pack
- communications_interactive_session_recorder
- blockchain_platform
- communications_messaging_server
- communications_pricing_design_center
- health_sciences_empirica_signal
- retail_service_backbone
- primavera_gateway
- communications_instant_messaging_server
- coherence
- utilities_framework
- goldengate_application_adapters
- commerce_platform
- communications_services_gatekeeper
- banking_treasury_management
quarkus
- quarkus
fedoraproject
- fedora
netapp
- service_level_manager
- oncommand_api_services
- oncommand_workflow_automation
apache
- iotdb
fasterxml
- jackson-databind
CWE
CWE-611
Improper Restriction of XML External Entity Reference