FlawAtlas
Search the atlas
CVE-2020-25649 High

XML External Entity (XXE) Injection in Jackson Databind

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.

Exploit probability 17.6%
Published February 18, 2021
Required by Not available
Last source change August 7, 2026

02 / AFFECTED SOFTWARE

Affected packages

Maven com.fasterxml.jackson.core:jackson-databind

83 explicit affected versions

Unknown Unknown

37 explicit affected versions

03 / CONNECTIONS

Connected vulnerabilities

04 / EVIDENCE

Source records

Open Source Vulnerabilities CVE-2020-25649

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.

View original source
Open Source Vulnerabilities GHSA-288c-cq4h-88gq

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.

View original source

05 / REFERENCES

Further evidence