Yüksek CVSS 7.5

CVE-2020-25649: Jackson-databind: XML dış varlık (XXE)

Yayın: 3 Aralık 2020 20:15 · Güncelleme: 6 Kasım 2026 09:48

Açıklama (NVD)

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.

Özet bilgiler

Ürün: Fasterxml Jackson-databind
CVSS v3.1: 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS: %17,71 (yüzdelik 97)
CWE: CWE-611
Yama: Mevcut

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
fasterxml-jackson-databind	2.6.0	—	2.6.7.4
fasterxml-jackson-databind	2.9.0	—	2.9.10.7
fasterxml-jackson-databind	2.10.0	—	2.10.5.1
netapp-oncommand-api-services	—	—	—
netapp-oncommand-workflow-automation	—	—	—
netapp-service-level-manager	—	—	—
fedoraproject-fedora	32	32	—
quarkus-quarkus	—	1.6.1	—
apache-iotdb	—	—	0.12.0
oracle-agile-product-lifecycle-management	9.3.6	9.3.6	—
oracle-agile-product-lifecycle-management-integration-pack	3.6	3.6	—
oracle-banking-apis	18.1	18.3	—
oracle-banking-apis	19.1	19.1	—
oracle-banking-apis	19.2	19.2	—
oracle-banking-apis	20.1	20.1	—
oracle-banking-apis	21.1	21.1	—
oracle-banking-platform	2.6.2	2.6.2	—
oracle-banking-platform	2.7.0	2.7.0	—
oracle-banking-platform	2.7.1	2.7.1	—
oracle-banking-platform	2.8.0	2.8.0	—
oracle-banking-platform	2.9.0	2.9.0	—
oracle-banking-platform	2.10.0	2.10.0	—
oracle-banking-treasury-management	4.4	4.4	—
oracle-blockchain-platform	—	—	21.1.2
oracle-coherence	12.2.1.4.0	12.2.1.4.0	—
oracle-coherence	14.1.1.0.0	14.1.1.0.0	—
oracle-commerce-platform	11.3.0	11.3.2	—
oracle-commerce-platform	11.2.0	11.2.0	—
oracle-communications-billing-and-revenue-management	7.5.0.23.0	7.5.0.23.0	—
oracle-communications-billing-and-revenue-management	12.0.0.3.0	12.0.0.3.0	—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları