What’s Vulnerable › Vulnerabilities
CVE-2020-25649: XML External Entity (XXE) Injection in Jackson Databind
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 17.7% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2020-12-03 · updated 2026-10-08
- Weakness: CWE-611
Description
A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.
Affected products
- Apache Software Foundation Apache IoTDB: before 0.12.0 — fixed in 0.12.0
- FasterXML jackson-databind: from 2.6.0 before 2.6.7.4; from 2.9.0 before 2.9.10.7; from 2.10.0 before 2.10.5.1 — fixed in 2.10.5.1, 2.6.7.4, 2.9.10.7
- Fedoraproject Fedora: 32
- NetApp Oncommand Api Services: all versions
- NetApp OnCommand Workflow Automation: all versions
- NetApp Service Level Manager: all versions
- Oracle Corporation Oracle Agile PLM: 9.3.6
- Oracle Agile Product Lifecycle Management Integration Pack: 3.6
- Oracle Banking Apis: from 18.1 through 18.3; 19.1, 19.2, 20.1, 21.1
- Oracle Banking Platform: 2.6.2, 2.7.0, 2.7.1, 2.8.0, 2.9.0, 2.10.0
- Oracle Corporation Banking Treasury Management: 4.4
- Oracle Blockchain Platform: before 21.1.2 — fixed in 21.1.2
- Oracle Corporation Oracle Coherence: 12.2.1.4.0, 14.1.1.0.0
- Oracle Corporation Oracle Commerce Platform: from 11.3.0 through 11.3.2; 11.2.0
- Oracle Corporation Communications Billing and Revenue Management: 7.5.0.23.0, 12.0.0.3.0
- Oracle Communications Cloud Native Core Unified Data Repository: 1.4.0
- Oracle Corporation Oracle Communications Convergent Charging Controller: 12.0.4.0.0
- Oracle Communications Evolved Communications Application Server: 7.1
- Oracle Communications Instant Messaging Server: 10.0.1.5.0
- Oracle Corporation Communications Interactive Session Recorder: 6.3, 6.4
- Oracle Communications Messaging Server: 8.0.2, 8.1
- Oracle Communications Network Charging And Control: 12.0.4.0.0
- Oracle Communications Offline Mediation Controller: 12.0.0.3
- Oracle Corporation Communications Pricing Design Center: 12.0.0.4.0
- Oracle Communications Services Gatekeeper: 7.0
- Oracle Corporation Oracle Communications Unified Inventory Management: 7.4.1
- Oracle Goldengate Application Adapters: 19.1.0.0.0
- Oracle Health Sciences Empirica Signal: 9.0, 9.1
- Oracle Insurance Policy Administration: from 11.1.0 through 11.3.0; 11.0.2
- Oracle Insurance Rules Palette: from 11.1.0 through 11.3.0; 11.0.2
How to fix
Upgrade to a fixed version: Apache Software Foundation Apache IoTDB 0.12.0; FasterXML jackson-databind 2.10.5.1, 2.6.7.4, 2.9.10.7; Oracle Blockchain Platform 21.1.2; Oracle Corporation JD Edwards EnterpriseOne Orchestrator 9.2.5.3; Oracle Corporation JD Edwards EnterpriseOne Tools 9.2.5.3; Maven Com.Fasterxml.Jackson.Core:Jackson-Databind 2.6.7.4, 2.9.10.7, 2.10.5.1. Check the vendor advisory for mitigations.
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1887664
- https://github.com/FasterXML/jackson-databind/issues/2589
- https://lists.apache.org/thread.html/r011d1430e8f40dff9550c3bc5d0f48b14c01ba8aecabd91d5e495386%40%3Ccommits.turbine.apache.org%3E
- https://lists.apache.org/thread.html/r024b7bda9c43c5560d81238748775c5ecfe01b57280f90df1f773949%40%3Cissues.hive.apache.org%3E
- https://lists.apache.org/thread.html/r04529cedaca40c2ff90af4880493f9c88a8ebf4d1d6c861d23108a5a%40%3Cnotifications.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r0881e23bd9034c8f51fdccdc8f4d085ba985dcd738f8520569ca5c3d%40%3Cissues.hive.apache.org%3E
- https://lists.apache.org/thread.html/r0b8dc3acd4503e4ecb6fbd6ea7d95f59941168d8452ac0ab1d1d96bb%40%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r1b7ed0c4b6c4301d4dfd6fdbc5581b0a789d3240cab55d766f33c6c6%40%3Cjira.kafka.apache.org%3E
- https://lists.apache.org/thread.html/r2882fc1f3032cd7be66e28787f04ec6f1874ac68d47e310e30ff7eb1%40%3Cjira.kafka.apache.org%3E
- https://lists.apache.org/thread.html/r2b6ddb3a4f4cd11d8f6305011e1b7438ba813511f2e3ab3180c7ffda%40%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r2eb66c182853c69ecfb52f63d3dec09495e9b65be829fd889a081ae1%40%3Cdev.hive.apache.org%3E
- https://lists.apache.org/thread.html/r2f5c5479f99398ef344b7ebd4d90bc3316236c45d0f3bc42090efcd7%40%3Cissues.hive.apache.org%3E
Get alerted when CVE-2020-25649 or the next vulnerability affects your stack