CVE-2020-25649
| Affected software | 10 products, listed below |
|---|---|
| Severity | 7.5 High CVSS 3.1 2 scores |
| Fixed in | 2.6.7.4, 2.9.10.7, 2.10.5.1 |
| Weakness | XML external entity (XXE) (CWE-611) |
| Published | 3 Dec 2020 |
| Updated | 8 Oct 2026 |
Description
A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.
Exploitation status
No public exploit
No exploit has been reported in the sources we check. Published 5 years ago.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment exploitation: none
- Indexed PoC none indexed
- EPSS 18% chance in 30 days A model's forecast, not a report of exploitation. Higher than 97% of all scored CVEs.
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full
- Action available patch rule
- Review human ARMR file
- Record active
| Decided by | An ARMR patch file on disk for this CVE |
|---|---|
| Finding | CVE has an ARMR patch rule that provides mitigation |
ARMR rule files
1 fileThe rule files Waratek ships for this CVE. Some CVEs need more than one, for example one per affected library or one per ARMR version.
CVE-2020-25649.armr patch rule, ARMR 2.6 added 2021-04-28 updated 2026-03-04How to mitigate CVE-2020-25649
Upgrade the affected software to a release that fixes it: 2.6.7.4, 2.9.10.7 or 2.10.5.1. Until you can, Waratek RASP blocks exploitation with a rule written for this CVE. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
CVSS
7.5 HIGH
v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
2 metrics
CVSS
7.5 HIGH v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
2 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
NVD | Primary | published |
| CVSS 2.0 | 5.0 | none | AV:N/AC:L/Au:N/C:N/I:P/A:N |
NVD | Primary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update April 2025 ↗ | CPU | 2025-Q2 | Oracle Fusion Middleware / Runtime Server (jackson-databind) (12.2.1.4.0) |
| Oracle Critical Patch Update April 2023 ↗ | CPU | 2023-Q2 | Oracle Insurance Applications / Logger (jackson-databind) (1.0.1.8) |
| Oracle Critical Patch Update July 2022 ↗ | CPU | 2022-Q3 | Oracle Supply Chain / Security (jackson-databind) (9.3.6) |
| Oracle Critical Patch Update April 2022 ↗ | CPU | 2022-Q2 | Oracle Fusion Middleware / Security Framework (jackson-databind) (12.2.1.3.0, 12.2.1.4.0) |
| Oracle Critical Patch Update January 2022 ↗ | CPU | 2022-Q1 | Oracle Financial Services Applications / Framework (jackson-databind) (18.1-18.3, 19.1, 19.2, 20.1, 21.1) Oracle Supply Chain / Installation Issues (jackson-databind) (3.6) |
| Oracle Critical Patch Update October 2021 ↗ | CPU | 2021-Q4 | Oracle Communications / IDIH - Visualization (jackson-databind) (8.0.0.0-8.5.0.0) Oracle Enterprise Manager / Load Testing for Web Apps (jackson-databind) (13.3.0.1) Oracle Financial Services Applications / Account (jackson-databind) (14.2, 14.3, 14.5) Oracle Financial Services Applications / Web UI (jackson-databind) (14.2, 14.3, 14.5) Oracle Fusion Middleware / Install, config, upgrade (jackson-databind) (12.2.1.4.0) Oracle Retail Applications / Foundation (jackson-databind) (15.0.3) Oracle Retail Applications / Segment (jackson-databind) (16.0-19.0) Oracle Supply Chain / Autovue Viewer Integration (jackson-databind) (21.0.2) |
| Oracle Critical Patch Update July 2021 ↗ | CPU | 2021-Q3 | Oracle Commerce / Dynamo Application Framework (jackson-databind) (11.2.0, 11.3.0-11.3.2) Oracle Communications / OCSG Policy service (jackson-databind) (7.0) Oracle Communications / Session Design Center GUI (jackson-databind) (7.1) Oracle Communications / UDR (jackson-databind) (1.4.0) Oracle Communications Applications / Business Operation Center (jackson-databind) (7.5.0.23.0, 12.0.0.3.0) Oracle Communications Applications / Common fns (jackson-databind) (12.0.4.0.0) Oracle Communications Applications / Media Resource (jackson-databind) (7.4.1) Oracle Communications Applications / OUI (jackson-databind) (12.0.4.0.0) Oracle Construction and Engineering / Admin (jackson-databind) (17.12.0-17.12.11, 18.8.0-18.8.11, 19.12.0-19.12.10, 20.12.0) Oracle Construction and Engineering / Project Delivery (jackson-databind) (17.7-17.12, 18.8, 19.12, 20.12) Oracle Financial Services Applications / Accounting (jackson-databind) (14.4) Oracle Fusion Middleware / Application Adapters (jackson-databind) (19.1.0.0.0) Oracle Insurance Applications / Architecture (jackson-databind) (11.0.2, 11.1.0-11.3.0) Oracle Insurance Applications / Architecture (jackson-databind) (11.0.2, 11.1.0-11.3.0) Oracle JD Edwards / E1 IOT Orchestrator Security (jackson-databind) (9.2.5.3 and prior) Oracle JD Edwards / Monitoring and Diagnostics SEC (jackson-databind) (9.2.5.3 and prior) Oracle JD Edwards / Web Runtime SEC (jackson-databind) (9.2.5.3 and prior) Oracle Retail Applications / RSB Installation (jackson-databind) (16.0.3.0, 15.0.3.1, 14.1.3.2) Oracle Retail Applications / Xenvironment (jackson-databind) (16.0.6, 17.0.4, 18.0.3, 19.0.2) |
| Oracle Critical Patch Update April 2021 ↗ | CPU | 2021-Q2 | Oracle Communications / Config (jackson-databind) (9.0) Oracle Communications / Provision API (jackson-databind) (6.3, 6.4) Oracle Financial Services Applications / Framework (jackson-databind) (2.6.2, 2.7.0, 2.7.1, 2.8.0, 2.9.0, 2.10.0) Oracle Fusion Middleware / Core (jackson-databind) (12.2.1.4.0, 14.1.1.0.0) Oracle Health Sciences Applications / Topics, REST Services (jackson-databind) (9.0, 9.1) Oracle Utilities Applications / General (jackson-databind) (4.3.0.5.0, 4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0, 4.4.0.3.0) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Commerce | Dynamo Application Framework (jackson-databind) | 11.2.0, 11.3.0-11.3.2 | 11.2.0 |
| Oracle Communications | Config (jackson-databind) | 9.0 | 9.0 |
| Oracle Communications | IDIH - Visualization (jackson-databind) | 8.0.0.0-8.5.0.0 | |
| Oracle Communications | OCSG Policy service (jackson-databind) | 7.0 | 7.0 |
| Oracle Communications | Provision API (jackson-databind) | 6.3, 6.4 | 6.3 · 6.4 |
| Oracle Communications | Session Design Center GUI (jackson-databind) | 7.1 | 7.1 |
| Oracle Communications | UDR (jackson-databind) | 1.4.0 | 1.4.0 |
| Oracle Communications Applications | Business Operation Center (jackson-databind) | 7.5.0.23.0, 12.0.0.3.0 | 7.5.0.23.0 · 12.0.0.3.0 |
| Oracle Communications Applications | Common fns (jackson-databind) | 12.0.4.0.0 | 12.0.4.0.0 |
| Oracle Communications Applications | Media Resource (jackson-databind) | 7.4.1 | 7.4.1 |
| Oracle Communications Applications | OUI (jackson-databind) | 12.0.4.0.0 | 12.0.4.0.0 |
| Oracle Construction and Engineering | Admin (jackson-databind) | 17.12.0-17.12.11, 18.8.0-18.8.11, 19.12.0-19.12.10, 20.12.0 | 20.12.0 |
| Oracle Construction and Engineering | Project Delivery (jackson-databind) | 17.7-17.12, 18.8, 19.12, 20.12 | 18.8 · 19.12 · 20.12 |
| Oracle Enterprise Manager | Load Testing for Web Apps (jackson-databind) | 13.3.0.1 | 13.3.0.1 |
| Oracle Financial Services Applications | Account (jackson-databind) | 14.2, 14.3, 14.5 | 14.2 · 14.3 · 14.5 |
| Oracle Financial Services Applications | Accounting (jackson-databind) | 14.4 | 14.4 |
| Oracle Financial Services Applications | Framework (jackson-databind) | 18.1-18.3, 19.1, 19.2, 20.1, 21.1 | 2.6.2 · 2.7.0 · 2.7.1 · 2.8.0 · 2.9.0 · 2.10.0 · 19.1 · 19.2 · 20.1 · 21.1 |
| Oracle Financial Services Applications | Web UI (jackson-databind) | 14.2, 14.3, 14.5 | 14.2 · 14.3 · 14.5 |
| Oracle Fusion Middleware | Application Adapters (jackson-databind) | 19.1.0.0.0 | 19.1.0.0.0 |
| Oracle Fusion Middleware | Core (jackson-databind) | 12.2.1.4.0, 14.1.1.0.0 | 12.2.1.4.0 · 14.1.1.0.0 |
| Oracle Fusion Middleware | Install, config, upgrade (jackson-databind) | 12.2.1.4.0 | 12.2.1.4.0 |
| Oracle Fusion Middleware | Runtime Server (jackson-databind) | 12.2.1.4.0 | 12.2.1.4.0 |
| Oracle Fusion Middleware | Security Framework (jackson-databind) | 12.2.1.3.0, 12.2.1.4.0 | 12.2.1.3.0 · 12.2.1.4.0 |
| Oracle Health Sciences Applications | Topics, REST Services (jackson-databind) | 9.0, 9.1 | 9.0 · 9.1 |
| Oracle Insurance Applications | Architecture (jackson-databind) | 11.0.2, 11.1.0-11.3.0 | 11.0.2 |
| Oracle Insurance Applications | Logger (jackson-databind) | 1.0.1.8 | 1.0.1.8 |
| Oracle JD Edwards | E1 IOT Orchestrator Security (jackson-databind) | 9.2.5.3 and prior | |
| Oracle JD Edwards | Monitoring and Diagnostics SEC (jackson-databind) | 9.2.5.3 and prior | |
| Oracle JD Edwards | Web Runtime SEC (jackson-databind) | 9.2.5.3 and prior | |
| Oracle Retail Applications | Foundation (jackson-databind) | 15.0.3 | 15.0.3 |
| Oracle Retail Applications | RSB Installation (jackson-databind) | 16.0.3.0, 15.0.3.1, 14.1.3.2 | 14.1.3.2 · 15.0.3.1 · 16.0.3.0 |
| Oracle Retail Applications | Segment (jackson-databind) | 16.0-19.0 | |
| Oracle Retail Applications | Xenvironment (jackson-databind) | 16.0.6, 17.0.4, 18.0.3, 19.0.2 | 16.0.6 · 17.0.4 · 18.0.3 · 19.0.2 |
| Oracle Supply Chain | Autovue Viewer Integration (jackson-databind) | 21.0.2 | 21.0.2 |
| Oracle Supply Chain | Installation Issues (jackson-databind) | 3.6 | 3.6 |
| Oracle Supply Chain | Security (jackson-databind) | 9.3.6 | 9.3.6 |
| Oracle Utilities Applications | General (jackson-databind) | 4.3.0.5.0, 4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0, 4.4.0.3.0 | 4.3.0.5.0 · 4.3.0.6.0 · 4.4.0.0.0 · 4.4.0.2.0 · 4.4.0.3.0 |
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
com.fasterxml.jackson.core:jackson-databind |
2.6.0 | 2.6.7.4 |
unbounded |
com.fasterxml.jackson.core:jackson-databind |
2.7.0.0 | 2.9.10.7 |
unbounded |
com.fasterxml.jackson.core:jackson-databind |
2.10.0.0 | 2.10.5.1 |
unbounded |
Products and versions
40 products, 76 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | apache | iotdb | generic | ＜ 0.12.0 |
| osv | com.fasterxml.jackson.core | jackson-databind | generic | ≥ 2.6.0 and ＜ 2.6.7.4 · ≥ 2.7.0.0 and ＜ 2.9.10.7 · ≥ 2.10.0.0 and ＜ 2.10.5.1 |
| nvd | fasterxml | jackson-databind | generic | ≥ 2.6.0 and ＜ 2.6.7.4 · ≥ 2.9.0 and ＜ 2.9.10.7 · ≥ 2.10.0 and ＜ 2.10.5.1 |
| nvd | fedoraproject | fedora | generic | 32 |
| nvd | netapp | oncommand api services | generic | any version |
| nvd | netapp | oncommand workflow automation | generic | any version |
| nvd | netapp | service level manager | generic | any version |
| nvd | oracle | agile product lifecycle management | generic | 9.3.6 |
| nvd | oracle | agile product lifecycle management integration pack | generic | 3.6 |
| nvd | oracle | banking apis | generic | ≥ 18.1 and ≤ 18.3 · 19.1 · 19.2 · 20.1 · 21.1 |
| nvd | oracle | banking platform | generic | 2.6.2 · 2.7.0 · 2.7.1 · 2.8.0 · 2.9.0 · 2.10.0 |
| nvd | oracle | banking treasury management | generic | 4.4 |
| nvd | oracle | blockchain platform | generic | ＜ 21.1.2 |
| nvd | oracle | coherence | generic | 12.2.1.4.0 · 14.1.1.0.0 |
| nvd | oracle | commerce platform | generic | 11.2.0 · ≥ 11.3.0 and ≤ 11.3.2 |
| nvd | oracle | communications billing and revenue management | generic | 7.5.0.23.0 · 12.0.0.3.0 |
| nvd | oracle | communications cloud native core unified data repository | generic | 1.4.0 |
| nvd | oracle | communications convergent charging controller | generic | 12.0.4.0.0 |
| nvd | oracle | communications evolved communications application server | generic | 7.1 |
| nvd | oracle | communications instant messaging server | generic | 10.0.1.5.0 |
| nvd | oracle | communications interactive session recorder | generic | 6.3 · 6.4 |
| nvd | oracle | communications messaging server | generic | 8.0.2 · 8.1 |
| nvd | oracle | communications network charging and control | generic | 12.0.4.0.0 |
| nvd | oracle | communications offline mediation controller | generic | 12.0.0.3 |
| nvd | oracle | communications pricing design center | generic | 12.0.0.4.0 |
| nvd | oracle | communications services gatekeeper | generic | 7.0 |
| nvd | oracle | communications unified inventory management | generic | 7.4.1 |
| nvd | oracle | goldengate application adapters | generic | 19.1.0.0.0 |
| nvd | oracle | health sciences empirica signal | generic | 9.0 · 9.1 |
| nvd | oracle | insurance policy administration | generic | 11.0.2 · ≥ 11.1.0 and ≤ 11.3.0 |
| nvd | oracle | insurance rules palette | generic | 11.0.2 · ≥ 11.1.0 and ≤ 11.3.0 |
| nvd | oracle | jd edwards enterpriseone orchestrator | generic | ＜ 9.2.5.3 |
| nvd | oracle | jd edwards enterpriseone tools | generic | ＜ 9.2.5.3 |
| nvd | oracle | primavera gateway | generic | ≥ 17.7 and ≤ 17.12 · ≥ 17.12.0 and ≤ 17.12.11 · ≥ 18.8.0 and ≤ 18.8.11 · ≥ 19.12.0 and ≤ 19.12.10 · 20.12.0 |
| nvd | oracle | retail service backbone | generic | 14.1.3.2 · 15.0.3.1 · 16.0.3 |
| nvd | oracle | retail xstore point of service | generic | 16.0.6 · 17.0.4 · 18.0.3 · 19.0.2 · 20.0.1 |
| nvd | oracle | sd-wan edge | generic | 9.0 |
| nvd | oracle | utilities framework | generic | 4.3.0.5.0 · 4.3.0.6.0 · 4.4.0.0.0 · 4.4.0.2.0 · 4.4.0.3.0 |
| nvd | oracle | webcenter portal | generic | 12.2.1.3.0 · 12.2.1.4.0 |
| nvd | quarkus | quarkus | generic | ≤ 1.6.1 |
References
Timeline
Timeline
| Published | 2020-12-03 | By the CVE Program. |
|---|---|---|
| ARMR remediation created | 2021-04-28 | Earliest commit adding this CVE's ARMR patch or security rule. |
| ARMR remediation last updated | 2026-03-04 | Most recent commit touching this CVE's ARMR patch or security rule. |
| Last VRT activity | 2026-03-04 | Most recent commit touching this CVE's classification, patch or rule file. |
| NVD record modified | 2026-10-08 | NVD's own last-modified date for this record. |