GitHub Advisoryadvisory · Maven

GHSA-288c-cq4h-88gq XML External Entity (XXE) Injection in Jackson Databind

HIGH Published 2021-02-18 Modified 2024-03-15 Official page ↗
Aliases
CVE-2020-25649
Ecosystem
Maven
Packages
com.fasterxml.jackson.core:jackson-databind
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-611
Reviewed
2021-02-18

Affected packages

• Maven com.fasterxml.jackson.core:jackson-databind: >= 2.6.0, < 2.6.7.4 → fixed in 2.6.7.4 • Maven com.fasterxml.jackson.core:jackson-databind: >= 2.7.0.0, < 2.9.10.7 → fixed in 2.9.10.7 • Maven com.fasterxml.jackson.core:jackson-databind: >= 2.10.0.0, < 2.10.5.1 → fixed in 2.10.5.1

Description

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.

Related

Alias · CVE (1)

  • CVE-2020-25649 A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References