Home

CVE-2020-25649

Description

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.

Risk Information

Base Score
7.5
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS Score
Exploitation Probability
0.018

Associated Vulnerability

VulnerabilityOS Platform
Vulnerabilities CVE-2020-25649,CVE-2021-20190 are fixed in Jackson-databind 2.9.10.7Windows
Vulnerabilities CVE-2020-25649 are fixed in Jackson-databind 2.10.5.1Windows
Vulnerabilities CVE-2020-25649,CVE-2020-10673,CVE-2020-8840,CVE-2019-20330 are fixed in Jackson-databind 2.6.7.4Windows
Multiple Vulnerabilities are affected in Netapp Oncommand Workflow Automation -Windows
Multiple vulnerabilities are affected in Oracle Commerce Platform 11.3.2Windows
Vulnerabilities CVE-2020-2555,CVE-2020-25649,CVE-2021-2463 are affected in Oracle Commerce Platform 11.2.0Windows
Multiple Vulnerabilities are affected in IBM Security Guardium 10.6Windows
Vulnerabilities CVE-2020-25649 are affected in JD Edwards EnterpriseOne Tools 9.2.5.2Windows
Vulnerabilities CVE-2020-25649 are affected in Oracle Corporation JD Edwards EnterpriseOne Orchestrator 9.2.5.2Windows
Multiple Vulnerabilities are affected in IBM Security Guardium 11.1Windows
Multiple Vulnerabilities are affected in IBM Security Guardium 11.2Windows
Multiple Vulnerabilities are affected in IBM Security Guardium 11.3Windows
Multiple Vulnerabilities are affected in IBM Security Guardium 11.4Windows
Multiple Vulnerabilities are affected in IBM Security Guardium 11.5Windows
Multiple Vulnerabilities are affected in IBM Sterling B2B Integrator 5.2.6.5Windows
Multiple Vulnerabilities are affected in IBM Security Guardium 11.0Windows
Multiple Vulnerabilities are affected in IBM Cognos Analytics 11.1Windows
Multiple Vulnerabilities are affected in IBM Cognos Analytics 11.2Windows
Multiple Vulnerabilities are affected in IBM Operational Decision Manager 8.11.0.1Windows
Multiple Vulnerabilities are affected in IBM Operational Decision Manager 8.11.1Windows
Multiple Vulnerabilities are affected in IBM Operational Decision Manager 8.10.4Windows
Multiple Vulnerabilities are affected in IBM Operational Decision Manager 8.10.5.2Windows
Multiple Vulnerabilities are affected in IBM Operational Decision Manager 8.12.0.1Windows
Multiple Vulnerabilities are affected in IBM Sterling B2B Integrator 6.0.3.3Windows
Multiple Vulnerabilities are affected in IBM Sterling B2B Integrator 6.1.0.1Windows
Vulnerabilities CVE-2020-25649,CVE-2021-20190 are fixed in Jackson-databind for Linux 2.9.10.7Linux
Vulnerabilities CVE-2020-25649 are fixed in Jackson-databind for Linux 2.10.5.1Linux
Vulnerabilities CVE-2020-25649,CVE-2020-10673,CVE-2020-8840,CVE-2019-20330 are fixed in Jackson-databind for Linux 2.6.7.4Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234