PT-2020-3454 · Oracle+6 · Java Se Embedded+10
Roman Shemyakin
·
Published
2020-07-14
·
Updated
2026-05-08
·
CVE-2020-14621
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Java SE versions 7u261, 8u251, 11.0.7, 14.0.1
Java SE Embedded version 8u251
Description
The issue is related to the JAXP component and is caused by inadequate access control. It allows an unauthenticated attacker with network access via multiple protocols to compromise Java SE and Java SE Embedded, resulting in unauthorized update, insert, or delete access to some accessible data. This can be exploited by supplying data to APIs in the specified component without using untrusted Java Web Start applications or untrusted Java applets, such as through a web service.
Recommendations
For Java SE versions 7u261, 8u251, 11.0.7, and 14.0.1, consider restricting access to the JAXP component until a patch is available.
For Java SE Embedded version 8u251, consider restricting access to the JAXP component until a patch is available.
As a temporary workaround, consider disabling the use of APIs in the JAXP component to minimize the risk of exploitation.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Centos
Ibm Aix
Jaxp
Java Platform
Java Se
Java Se Embedded
Java Web Start
Linuxmint
Red Hat
Suse
Ubuntu