Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-fh2c-k8s4-g3fh
Vulnerability ID VCID-fh2c-k8s4-g3fh
Aliases CVE-2020-14621
Summary OpenJDK: XML validation manipulation due to incomplete application of the use-grammar-pool-only feature (JAXP, 8242136)
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-20 Improper Input Validation
System Score Found at
cvssv3.1 5.3 http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00019.html
ssvc Track http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00019.html
cvssv3.1 5.3 http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00027.html
ssvc Track http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00027.html
cvssv3.1 5.3 http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html
ssvc Track http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html
cvssv3 5.3 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-14621.json
epss 0.00474 https://api.first.org/data/v1/epss?cve=CVE-2020-14621
cvssv3.1 5.3 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 5.3 https://kc.mcafee.com/corporate/index?page=content&id=SB10332
ssvc Track https://kc.mcafee.com/corporate/index?page=content&id=SB10332
cvssv3.1 5.3 https://lists.apache.org/thread.html/rf96c5afb26b596b4b97883aa90b6c0b0fc4c26aaeea7123c21912103%40%3Cj-users.xerces.apache.org%3E
ssvc Track https://lists.apache.org/thread.html/rf96c5afb26b596b4b97883aa90b6c0b0fc4c26aaeea7123c21912103%40%3Cj-users.xerces.apache.org%3E
cvssv3.1 5.3 https://lists.debian.org/debian-lts-announce/2020/08/msg00021.html
ssvc Track https://lists.debian.org/debian-lts-announce/2020/08/msg00021.html
cvssv3.1 5.3 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CFJPOYF3CWYEPCDOAOCNFJTQIKKWPHW/
ssvc Track https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CFJPOYF3CWYEPCDOAOCNFJTQIKKWPHW/
cvssv3.1 5.3 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DFZ36XIW5ENQAW6BB7WHRFFTTJX7KGMR/
ssvc Track https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DFZ36XIW5ENQAW6BB7WHRFFTTJX7KGMR/
cvssv3.1 5.3 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MEPHBZPNSLX43B26DWKB7OS6AROTS2BO/
ssvc Track https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MEPHBZPNSLX43B26DWKB7OS6AROTS2BO/
cvssv3.1 5.3 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QQUMIAON2YEFRONMIUVHAKYCIOLICDBA/
ssvc Track https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QQUMIAON2YEFRONMIUVHAKYCIOLICDBA/
cvssv3.1 5.3 https://security.gentoo.org/glsa/202008-24
ssvc Track https://security.gentoo.org/glsa/202008-24
cvssv3.1 5.3 https://security.gentoo.org/glsa/202209-15
ssvc Track https://security.gentoo.org/glsa/202209-15
cvssv3.1 5.3 https://security.netapp.com/advisory/ntap-20200717-0005/
ssvc Track https://security.netapp.com/advisory/ntap-20200717-0005/
cvssv3.1 5.3 https://usn.ubuntu.com/4433-1/
ssvc Track https://usn.ubuntu.com/4433-1/
cvssv3.1 5.3 https://usn.ubuntu.com/4453-1/
ssvc Track https://usn.ubuntu.com/4453-1/
cvssv3.1 5.3 https://www.debian.org/security/2020/dsa-4734
ssvc Track https://www.debian.org/security/2020/dsa-4734
cvssv3.1 5.3 https://www.oracle.com/security-alerts/cpujul2020.html
ssvc Track https://www.oracle.com/security-alerts/cpujul2020.html
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-14621.json
https://api.first.org/data/v1/epss?cve=CVE-2020-14621
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14556
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14562
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14573
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14577
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14578
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14579
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14581
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14583
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14593
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14621
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
1856885 https://bugzilla.redhat.com/show_bug.cgi?id=1856885
4433-1 https://usn.ubuntu.com/4433-1/
4453-1 https://usn.ubuntu.com/4453-1/
6CFJPOYF3CWYEPCDOAOCNFJTQIKKWPHW https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CFJPOYF3CWYEPCDOAOCNFJTQIKKWPHW/
DFZ36XIW5ENQAW6BB7WHRFFTTJX7KGMR https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DFZ36XIW5ENQAW6BB7WHRFFTTJX7KGMR/
dsa-4734 https://www.debian.org/security/2020/dsa-4734
GLSA-202008-24 https://security.gentoo.org/glsa/202008-24
GLSA-202209-15 https://security.gentoo.org/glsa/202209-15
GLSA-202409-26 https://security.gentoo.org/glsa/202409-26
MEPHBZPNSLX43B26DWKB7OS6AROTS2BO https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MEPHBZPNSLX43B26DWKB7OS6AROTS2BO/
msg00019.html http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00019.html
msg00021.html https://lists.debian.org/debian-lts-announce/2020/08/msg00021.html
msg00027.html http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00027.html
msg00041.html http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html
ntap-20200717-0005 https://security.netapp.com/advisory/ntap-20200717-0005/
QQUMIAON2YEFRONMIUVHAKYCIOLICDBA https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QQUMIAON2YEFRONMIUVHAKYCIOLICDBA/
rf96c5afb26b596b4b97883aa90b6c0b0fc4c26aaeea7123c21912103%40%3Cj-users.xerces.apache.org%3E https://lists.apache.org/thread.html/rf96c5afb26b596b4b97883aa90b6c0b0fc4c26aaeea7123c21912103%40%3Cj-users.xerces.apache.org%3E
RHSA-2020:2968 https://access.redhat.com/errata/RHSA-2020:2968
RHSA-2020:2969 https://access.redhat.com/errata/RHSA-2020:2969
RHSA-2020:2970 https://access.redhat.com/errata/RHSA-2020:2970
RHSA-2020:2972 https://access.redhat.com/errata/RHSA-2020:2972
RHSA-2020:2985 https://access.redhat.com/errata/RHSA-2020:2985
RHSA-2020:3098 https://access.redhat.com/errata/RHSA-2020:3098
RHSA-2020:3099 https://access.redhat.com/errata/RHSA-2020:3099
RHSA-2020:3100 https://access.redhat.com/errata/RHSA-2020:3100
RHSA-2020:3101 https://access.redhat.com/errata/RHSA-2020:3101
RHSA-2020:3386 https://access.redhat.com/errata/RHSA-2020:3386
RHSA-2020:3387 https://access.redhat.com/errata/RHSA-2020:3387
RHSA-2020:3388 https://access.redhat.com/errata/RHSA-2020:3388
RHSA-2020:5585 https://access.redhat.com/errata/RHSA-2020:5585
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00019.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-27T17:53:09Z/ Found at http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00019.html
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00027.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-27T17:53:09Z/ Found at http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00027.html
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-27T17:53:09Z/ Found at http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-14621.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://kc.mcafee.com/corporate/index?page=content&id=SB10332
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-27T17:53:09Z/ Found at https://kc.mcafee.com/corporate/index?page=content&id=SB10332
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://lists.apache.org/thread.html/rf96c5afb26b596b4b97883aa90b6c0b0fc4c26aaeea7123c21912103%40%3Cj-users.xerces.apache.org%3E
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-27T17:53:09Z/ Found at https://lists.apache.org/thread.html/rf96c5afb26b596b4b97883aa90b6c0b0fc4c26aaeea7123c21912103%40%3Cj-users.xerces.apache.org%3E
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://lists.debian.org/debian-lts-announce/2020/08/msg00021.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-27T17:53:09Z/ Found at https://lists.debian.org/debian-lts-announce/2020/08/msg00021.html
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CFJPOYF3CWYEPCDOAOCNFJTQIKKWPHW/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-27T17:53:09Z/ Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CFJPOYF3CWYEPCDOAOCNFJTQIKKWPHW/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DFZ36XIW5ENQAW6BB7WHRFFTTJX7KGMR/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-27T17:53:09Z/ Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DFZ36XIW5ENQAW6BB7WHRFFTTJX7KGMR/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MEPHBZPNSLX43B26DWKB7OS6AROTS2BO/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-27T17:53:09Z/ Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MEPHBZPNSLX43B26DWKB7OS6AROTS2BO/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QQUMIAON2YEFRONMIUVHAKYCIOLICDBA/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-27T17:53:09Z/ Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QQUMIAON2YEFRONMIUVHAKYCIOLICDBA/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://security.gentoo.org/glsa/202008-24
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-27T17:53:09Z/ Found at https://security.gentoo.org/glsa/202008-24
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://security.gentoo.org/glsa/202209-15
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-27T17:53:09Z/ Found at https://security.gentoo.org/glsa/202209-15
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://security.netapp.com/advisory/ntap-20200717-0005/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-27T17:53:09Z/ Found at https://security.netapp.com/advisory/ntap-20200717-0005/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://usn.ubuntu.com/4433-1/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-27T17:53:09Z/ Found at https://usn.ubuntu.com/4433-1/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://usn.ubuntu.com/4453-1/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-27T17:53:09Z/ Found at https://usn.ubuntu.com/4453-1/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://www.debian.org/security/2020/dsa-4734
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-27T17:53:09Z/ Found at https://www.debian.org/security/2020/dsa-4734
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://www.oracle.com/security-alerts/cpujul2020.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-27T17:53:09Z/ Found at https://www.oracle.com/security-alerts/cpujul2020.html
Exploit Prediction Scoring System (EPSS)
Percentile 0.65049
EPSS Score 0.00474
Published At May 29, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-29T09:20:24.751034+00:00 RedHat Importer Import https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-14621.json 38.6.0