A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
Configuration 5 (hide)
|
Configuration 6 (hide)
|
History
No history.
Information
Published : 2020-12-03 17:15
Updated : 2026-08-25 16:28
NVD link : CVE-2020-25649
Mitre link : CVE-2020-25649
CVE.ORG link : CVE-2020-25649
JSON object : View
Products Affected
oracle
- communications_unified_inventory_management
- communications_offline_mediation_controller
- utilities_framework
- banking_treasury_management
- retail_service_backbone
- communications_network_charging_and_control
- commerce_platform
- agile_product_lifecycle_management_integration_pack
- communications_messaging_server
- communications_cloud_native_core_unified_data_repository
- communications_interactive_session_recorder
- coherence
- communications_billing_and_revenue_management
- blockchain_platform
- health_sciences_empirica_signal
- communications_instant_messaging_server
- insurance_rules_palette
- jd_edwards_enterpriseone_tools
- webcenter_portal
- banking_platform
- communications_services_gatekeeper
- retail_xstore_point_of_service
- sd-wan_edge
- communications_convergent_charging_controller
- goldengate_application_adapters
- insurance_policy_administration
- primavera_gateway
- agile_product_lifecycle_management
- banking_apis
- communications_pricing_design_center
- jd_edwards_enterpriseone_orchestrator
- communications_evolved_communications_application_server
fedoraproject
- fedora
netapp
- oncommand_workflow_automation
- service_level_manager
- oncommand_api_services
apache
- iotdb
fasterxml
- jackson-databind
quarkus
- quarkus
CWE
CWE-611
Improper Restriction of XML External Entity Reference
