Vulnerabilities > CVE-2020-25649 - XXE vulnerability in multiple products

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

HIGH

Availability impact

NONE

network

low complexity

NVD

Published: 2020-12-03

Updated: 2023-11-07

Summary

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.

Vulnerable Configurations

Part	Description	Count
Application	Fasterxml Fasterxml Jackson Databind 2.10.0 Fasterxml Jackson Databind 2.10.1 Fasterxml Jackson Databind 2.10.2 Fasterxml Jackson Databind 2.10.3 Fasterxml Jackson Databind 2.10.4 Fasterxml Jackson Databind 2.10.5 Fasterxml Jackson Databind 2.9.0 Fasterxml Jackson Databind 2.9.1 Fasterxml Jackson Databind 2.9.2 Fasterxml Jackson Databind 2.9.3 Fasterxml Jackson Databind 2.9.4 Fasterxml Jackson Databind 2.9.5 Fasterxml Jackson Databind 2.9.6 Fasterxml Jackson Databind 2.9.7 Fasterxml Jackson Databind 2.9.8 Fasterxml Jackson Databind 2.9.9 Fasterxml Jackson Databind 2.9.9.1 Fasterxml Jackson Databind 2.9.9.2 Fasterxml Jackson Databind 2.9.9.3 Fasterxml Jackson Databind 2.9.9.4 Fasterxml Jackson Databind 2.9.10 Fasterxml Jackson Databind 2.9.10.1 Fasterxml Jackson Databind 2.9.10.2 Fasterxml Jackson Databind 2.9.10.3 Fasterxml Jackson Databind 2.9.10.4 Fasterxml Jackson Databind 2.9.10.5 Fasterxml Jackson Databind 2.9.10.6 Fasterxml Jackson Databind 2.6.0 Fasterxml Jackson Databind 2.6.1 Fasterxml Jackson Databind 2.6.2 Fasterxml Jackson Databind 2.6.3 Fasterxml Jackson Databind 2.6.4 Fasterxml Jackson Databind 2.6.5 Fasterxml Jackson Databind 2.6.6 Fasterxml Jackson Databind 2.6.7 Fasterxml Jackson Databind 2.6.7.1 Fasterxml Jackson Databind 2.6.7.2 Fasterxml Jackson Databind 2.6.7.3	52
Application	Netapp Netapp Oncommand Workflow Automation - Netapp Service Level Manager - Netapp Oncommand API Services -	3
Application	Quarkus Quarkus Quarkus 0.0.1 Quarkus Quarkus 0.1.0 Quarkus Quarkus 0.2.0 Quarkus Quarkus 0.3.0 Quarkus Quarkus 0.4.0 Quarkus Quarkus 0.5.0 Quarkus Quarkus 0.6.0 Quarkus Quarkus 0.7.0 Quarkus Quarkus 0.8.0 Quarkus Quarkus 0.9.0 Quarkus Quarkus 0.9.1 Quarkus Quarkus 0.10.0 Quarkus Quarkus 0.11.0 Quarkus Quarkus 0.12.0 Quarkus Quarkus 0.13.0 Quarkus Quarkus 0.13.1 Quarkus Quarkus 0.13.2 Quarkus Quarkus 0.13.3 Quarkus Quarkus 0.14.0 Quarkus Quarkus 0.15.0 Quarkus Quarkus 0.16.0 Quarkus Quarkus 0.16.1 Quarkus Quarkus 0.17.0 Quarkus Quarkus 0.18.0 Quarkus Quarkus 0.19.0 Quarkus Quarkus 0.19.1 Quarkus Quarkus 0.20.0 Quarkus Quarkus 0.21.0 Quarkus Quarkus 0.21.1 Quarkus Quarkus 0.21.2 Quarkus Quarkus 0.22.0 Quarkus Quarkus 0.23.0 Quarkus Quarkus 0.23.1 Quarkus Quarkus 0.23.2 Quarkus Quarkus 0.24.0 Quarkus Quarkus 0.25.0 Quarkus Quarkus 0.26.0 Quarkus Quarkus 0.26.1 Quarkus Quarkus 0.27.0 Quarkus Quarkus 0.28.0 Quarkus Quarkus 0.28.1 Quarkus Quarkus 1.0.0 Quarkus Quarkus 1.0.1 Quarkus Quarkus 1.1.0 Quarkus Quarkus 1.1.1 Quarkus Quarkus 1.2.0 Quarkus Quarkus 1.2.1 Quarkus Quarkus 1.3.0 Quarkus Quarkus 1.3.1 Quarkus Quarkus 1.3.2 Quarkus Quarkus 1.3.3 Quarkus Quarkus 1.3.4 Quarkus Quarkus 1.4.0 Quarkus Quarkus 1.4.1 Quarkus Quarkus 1.4.2 Quarkus Quarkus 1.5.0 Quarkus Quarkus 1.5.1 Quarkus Quarkus 1.5.2 Quarkus Quarkus 1.6.0 Quarkus Quarkus 1.6.1	80
Application	Apache Apache Iotdb - Apache Iotdb 0.8.0 Apache Iotdb 0.8.1 Apache Iotdb 0.8.2 Apache Iotdb 0.9.0 Apache Iotdb 0.9.1 Apache Iotdb 0.9.2 Apache Iotdb 0.9.3 Apache Iotdb 0.10.0 Apache Iotdb 0.10.1 Apache Iotdb 0.11.0 Apache Iotdb 0.11.1 Apache Iotdb 0.11.2 Apache Iotdb 0.11.3 Apache Iotdb 0.11.4	15
Application	Oracle Oracle Webcenter Portal 12.2.1.3.0 Oracle Webcenter Portal 12.2.1.4.0 Oracle Banking Platform 2.6.2 Oracle Banking Platform 2.7.0 Oracle Banking Platform 2.7.1 Oracle Banking Platform 2.9.0 Oracle Banking Platform 2.8.0 Oracle Banking Platform 2.10.0 Oracle Utilities Framework 4.3.0.5.0 Oracle Utilities Framework 4.3.0.6.0 Oracle Utilities Framework 4.4.0.0.0 Oracle Utilities Framework 4.4.0.2.0 Oracle Utilities Framework 4.4.0.3.0 Oracle Agile PLM 9.3.6 Oracle Coherence 12.2.1.4.0 Oracle Coherence 14.1.1.0.0 Oracle SD WAN Edge 9.0 Oracle Communications Billing AND Revenue Management 12.0.0.3.0 Oracle Communications Billing AND Revenue Management 7.5.0.23.0 Oracle Communications Services Gatekeeper 7.0 Oracle Communications Evolved Communications Application Server 7.1 Oracle Goldengate Application Adapters 19.1.0.0.0 Oracle Retail Service Backbone 16.0.3 Oracle Retail Service Backbone 15.0.3.1 Oracle Retail Service Backbone 14.1.3.2 Oracle Primavera Gateway 17.7 Oracle Primavera Gateway 17.12 Oracle Primavera Gateway 20.12.0 Oracle Primavera Gateway 19.12.0 Oracle Primavera Gateway 19.12.4 Oracle Primavera Gateway 19.12.10 Oracle Primavera Gateway 18.8.0 Oracle Primavera Gateway 18.8.8 Oracle Primavera Gateway 18.8.8.1 Oracle Primavera Gateway 18.8.9 Oracle Primavera Gateway 18.8.11 Oracle Primavera Gateway 17.12.0 Oracle Primavera Gateway 17.12.6 Oracle Primavera Gateway 17.12.7 Oracle Primavera Gateway 17.12.8 Oracle Primavera Gateway 17.12.9 Oracle Primavera Gateway 17.12.10 Oracle Primavera Gateway 17.12.11 Oracle Insurance Rules Palette 11.0.2 Oracle Insurance Rules Palette 11.1.0 Oracle Insurance Rules Palette 11.1.0.15 Oracle Insurance Rules Palette 11.2.0 Oracle Insurance Rules Palette 11.2.0.26 Oracle Insurance Rules Palette 11.2.7 Oracle Insurance Rules Palette 11.2.8 Oracle Insurance Rules Palette 11.3.0 Oracle Communications Interactive Session Recorder 6.3 Oracle Communications Interactive Session Recorder 6.4 Oracle Commerce Platform 11.3.0 Oracle Commerce Platform 11.3.1 Oracle Commerce Platform 11.3.2 Oracle Commerce Platform 11.2.0 Oracle Communications Unified Inventory Management 7.4.1 Oracle Retail Xstore Point OF Service 16.0.6 Oracle Retail Xstore Point OF Service 17.0.4 Oracle Retail Xstore Point OF Service 18.0.3 Oracle Retail Xstore Point OF Service 19.0.2 Oracle Retail Xstore Point OF Service 20.0.1 Oracle Health Sciences Empirica Signal 9.0 Oracle Health Sciences Empirica Signal 9.1 Oracle JD Edwards Enterpriseone Tools - Oracle JD Edwards Enterpriseone Tools 4.0.1.0 Oracle JD Edwards Enterpriseone Tools 9.1 Oracle JD Edwards Enterpriseone Tools 9.1.5 Oracle JD Edwards Enterpriseone Tools 9.2 Oracle JD Edwards Enterpriseone Tools 9.2.4.0 Oracle JD Edwards Enterpriseone Tools 9.2.4.2 Oracle JD Edwards Enterpriseone Tools 9.2.5.0 Oracle JD Edwards Enterpriseone Tools 9.2.5.3 Oracle JD Edwards Enterpriseone Orchestrator - Oracle JD Edwards Enterpriseone Orchestrator 9.2 Oracle JD Edwards Enterpriseone Orchestrator 9.2.4.2 Oracle JD Edwards Enterpriseone Orchestrator 9.2.5.0 Oracle JD Edwards Enterpriseone Orchestrator 9.2.5.1 Oracle Insurance Policy Administration 11.1.0 Oracle Insurance Policy Administration 11.2.0 Oracle Insurance Policy Administration 11.2.7 Oracle Insurance Policy Administration 11.2.8 Oracle Insurance Policy Administration 11.3.0 Oracle Insurance Policy Administration 11.0.2 Oracle Banking Treasury Management 4.4 Oracle Communications Cloud Native Core Unified Data Repository 1.4.0 Oracle Communications Network Charging AND Control 12.0.4.0.0 Oracle Communications Convergent Charging Controller 12.0.4.0.0 Oracle Agile Product Lifecycle Management Integration Pack 3.6 Oracle Communications Pricing Design Center 12.0.0.4.0 Oracle Banking Apis 18.1 Oracle Banking Apis 18.2 Oracle Banking Apis 18.3 Oracle Banking Apis 19.1 Oracle Banking Apis 19.2 Oracle Banking Apis 20.1 Oracle Banking Apis 21.1 Oracle Communications Instant Messaging Server 10.0.1.5.0 Oracle Communications Offline Mediation Controller 12.0.0.3 Oracle Blockchain Platform -	101
OS	Fedoraproject Fedoraproject Fedora 32	1
OS	Oracle Oracle Communications Messaging Server 8.1 Oracle Communications Messaging Server 8.0.2	2

Common Weakness Enumeration (CWE)

CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

References

CVE is a registered MITRE Corporation trademark and MITRE's CVE website is the authoritative source of CVE content. CWE is a registered MITRE Corporation trademark and MITRE's CWE website is the authoritative source of CWE content.