NetSight
IP …
high7.5

CVE-2020-25649

XML External Entity (XXE) Injection in Jackson Databind

Impact

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.

Affected packages

EcosystemPackageAffectedFixed in
mavencom.fasterxml.jackson.core:jackson-databind>= 2.7.0.0, <= 2.9.10.62.9.10.7

Affected products

VendorProductAffected versions
FasterxmlJackson-Databind
from 2.6.0 before 2.6.7.4
from 2.9.0 before 2.9.10.7
from 2.10.0 before 2.10.5.1
NetappOncommand Api Services
All versions
NetappOncommand Workflow Automation
All versions
NetappService Level Manager
All versions
FedoraprojectFedora
Version 32
QuarkusQuarkus
through 1.6.1
ApacheIotdb
before 0.12.0
OracleAgile Product Lifecycle Management
Version 9.3.6
OracleAgile Product Lifecycle Management Integration Pack
Version 3.6
OracleBanking Apis
from 18.1 through 18.3
Versions 19.1, 19.2, 20.1, 21.1
OracleBanking Platform
Versions 2.6.2, 2.7.0, 2.7.1, 2.8.0, 2.9.0, 2.10.0
OracleBanking Treasury Management
Version 4.4

Weakness classification

CWE-611

References