CVE-2020-25649

Published: Dec 3, 2020Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.

Vulnerable Software	Affected Versions
Fasterxml Jackson Databind	From 2.10.0 to 2.10.5.1
Fasterxml Jackson Databind	From 2.6.0 to 2.6.7.4
Fasterxml Jackson Databind	From 2.9.0 to 2.9.10.7

Vulnerable Software	Affected Versions
Netapp Oncommand Api Services	All versions
Netapp Oncommand Workflow Automation	All versions
Netapp Service Level Manager	All versions

Vulnerable Software	Affected Versions
Oracle Agile Plm	Version 9.3.6
Oracle Agile Product Lifecycle Management Integration Pack	Version 3.6
Oracle Banking Apis	From 18.1 to 18.3
Oracle Banking Apis	Version 19.1
Oracle Banking Apis	Version 19.2
Oracle Banking Apis	Version 20.1
Oracle Banking Apis	Version 21.1
Oracle Banking Platform	Version 2.10.0
Oracle Banking Platform	Version 2.6.2
Oracle Banking Platform	Version 2.7.0
Oracle Banking Platform	Version 2.7.1
Oracle Banking Platform	Version 2.8.0
Oracle Banking Platform	Version 2.9.0
Oracle Banking Treasury Management	Version 4.4
Oracle Blockchain Platform	Before 21.1.2
Oracle Coherence	Version 12.2.1.4.0
Oracle Coherence	Version 14.1.1.0.0
Oracle Commerce Platform	From 11.3.0 to 11.3.2
Oracle Commerce Platform	Version 11.2.0
Oracle Communications Billing And Revenue Management	Version 12.0.0.3.0
Oracle Communications Billing And Revenue Management	Version 7.5.0.23.0
Oracle Communications Cloud Native Core Unified Data Repository	Version 1.4.0
Oracle Communications Convergent Charging Controller	Version 12.0.4.0.0
Oracle Communications Evolved Communications Application Server	Version 7.1
Oracle Communications Instant Messaging Server	Version 10.0.1.5.0
Oracle Communications Interactive Session Recorder	Version 6.3
Oracle Communications Interactive Session Recorder	Version 6.4
Oracle Communications Messaging Server	Version 8.0.2
Oracle Communications Messaging Server	Version 8.1
Oracle Communications Network Charging And Control	Version 12.0.4.0.0
Oracle Communications Offline Mediation Controller	Version 12.0.0.3
Oracle Communications Pricing Design Center	Version 12.0.0.4.0
Oracle Communications Services Gatekeeper	Version 7.0
Oracle Communications Unified Inventory Management	Version 7.4.1
Oracle Goldengate Application Adapters	Version 19.1.0.0.0
Oracle Health Sciences Empirica Signal	Version 9.0
Oracle Health Sciences Empirica Signal	Version 9.1
Oracle Insurance Policy Administration	From 11.1.0 to 11.3.0
Oracle Insurance Policy Administration	Version 11.0.2
Oracle Insurance Rules Palette	From 11.1.0 to 11.3.0
Oracle Insurance Rules Palette	Version 11.0.2
Oracle Jd Edwards Enterpriseone Orchestrator	Before 9.2.5.3
Oracle Jd Edwards Enterpriseone Tools	Before 9.2.5.3
Oracle Primavera Gateway	From 17.12.0 to 17.12.11
Oracle Primavera Gateway	From 17.7 to 17.12
Oracle Primavera Gateway	From 18.8.0 to 18.8.11
Oracle Primavera Gateway	From 19.12.0 to 19.12.10
Oracle Primavera Gateway	Version 20.12.0
Oracle Retail Service Backbone	Version 14.1.3.2
Oracle Retail Service Backbone	Version 15.0.3.1
Oracle Retail Service Backbone	Version 16.0.3
Oracle Retail Xstore Point Of Service	Version 16.0.6
Oracle Retail Xstore Point Of Service	Version 17.0.4
Oracle Retail Xstore Point Of Service	Version 18.0.3
Oracle Retail Xstore Point Of Service	Version 19.0.2
Oracle Retail Xstore Point Of Service	Version 20.0.1
Oracle Sd Wan Edge	Version 9.0
Oracle Utilities Framework	Version 4.3.0.5.0
Oracle Utilities Framework	Version 4.3.0.6.0
Oracle Utilities Framework	Version 4.4.0.0.0
Oracle Utilities Framework	Version 4.4.0.2.0
Oracle Utilities Framework	Version 4.4.0.3.0
Oracle Webcenter Portal	Version 12.2.1.3.0
Oracle Webcenter Portal	Version 12.2.1.4.0

CVE-2020-25649

Description

Affected (73)

Related CWEs

References (142)

Timeline