CVE-2020-25649: Apache Iotdb

High severity, CVSS 7.5. EPSS: 17.3% chance of exploitation in the next 30 days.

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.

Affected products

  • Apache Iotdb: before 0.12.0 (fixed in 0.12.0)
  • Fasterxml Jackson-Databind: from 2.6.0, before 2.6.7.4 (fixed in 2.6.7.4); from 2.9.0, before 2.9.10.7 (fixed in 2.9.10.7); from 2.10.0, before 2.10.5.1 (fixed in 2.10.5.1)
  • Fedoraproject Fedora: version 32 only
  • Netapp Oncommand API Services: affected versions not specified
  • Netapp Oncommand Workflow Automation: affected versions not specified
  • Netapp Service Level Manager: affected versions not specified
  • Oracle Agile Product Lifecycle Management: version 9.3.6 only
  • Oracle Agile Product Lifecycle Management Integration Pack: version 3.6 only
  • Oracle Banking Apis: from 18.1, up to and including 18.3; version 19.1 only; version 19.2 only; version 20.1 only; version 21.1 only
  • Oracle Banking Platform: version 2.6.2 only; version 2.7.0 only; version 2.7.1 only; version 2.8.0 only; version 2.9.0 only; version 2.10.0 only
  • Oracle Banking Treasury Management: version 4.4 only
  • Oracle Blockchain Platform: before 21.1.2 (fixed in 21.1.2)
  • Oracle Coherence: version 12.2.1.4.0 only; version 14.1.1.0.0 only
  • Oracle Commerce Platform: from 11.3.0, up to and including 11.3.2; version 11.2.0 only
  • Oracle Communications Billing And Revenue Management: version 7.5.0.23.0 only; version 12.0.0.3.0 only
  • Oracle Communications Cloud Native Core Unified Data Repository: version 1.4.0 only
  • Oracle Communications Convergent Charging Controller: version 12.0.4.0.0 only
  • Oracle Communications Evolved Communications Application Server: version 7.1 only
  • Oracle Communications Instant Messaging Server: version 10.0.1.5.0 only
  • Oracle Communications Interactive Session Recorder: version 6.3 only; version 6.4 only
  • Oracle Communications Messaging Server: version 8.0.2 only; version 8.1 only
  • Oracle Communications Network Charging And Control: version 12.0.4.0.0 only
  • Oracle Communications Offline Mediation Controller: version 12.0.0.3 only
  • Oracle Communications Pricing Design Center: version 12.0.0.4.0 only
  • Oracle Communications Services Gatekeeper: version 7.0 only
  • and 14 more

Published 2020-12-03. Last modified 2026-10-08.