CVE Catalog
CVE-2020-25649
HighCVSS 7.5Exploitation Probability (EPSS)
Very high risk17.61%
97th percentile - higher than 97% of all known CVEs
Summary
A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.
Risk Assessment
An attacker could exploit XXE to read files or make server-side requests, potentially compromising data integrity.
Recommendation
Update FasterXML Jackson Databind to a version that includes a fix for entity expansion security.
Original NVD description (English source)
A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.