Back to Database
Status published
Critical
CVE-2020-10683
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs...
Vulnerability Description
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-10683
Credits & Attribution
No credits recorded in the NVD database.
References
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00061.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1694235
- https://github.com/dom4j/dom4j/releases/tag/version-2.1.3
- https://github.com/dom4j/dom4j/commit/a8228522a99a02146106672a34c104adbda5c658
- https://security.netapp.com/advisory/ntap-20200518-0002/
- https://usn.ubuntu.com/4575-1/
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://github.com/dom4j/dom4j/issues/87
- https://github.com/dom4j/dom4j/commits/version-2.0.3
- https://lists.apache.org/thread.html/r51f3f9801058e47153c0ad9bc6209d57a592fc0e7aefd787760911b8%40%3Cdev.velocity.apache.org%3E
- https://lists.apache.org/thread.html/r91c64cd51e68e97d524395474eaa25362d564572276b9917fcbf5c32%40%3Cdev.velocity.apache.org%3E
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://lists.apache.org/thread.html/rb1b990d7920ae0d50da5109b73b92bab736d46c9788dd4b135cb1a51%40%3Cnotifications.freemarker.apache.org%3E
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
More from dom4j project
View All →Affected Vendor
dom4j project
View all reports →Affected Software
dom4j, agile plm, application testing suite, banking platform, business process management suite, communications application session controller, communications diameter signaling router, communications unified inventory management, data integrator, documaker, endeca information discovery integrator, enterprise data quality, enterprise manager base platform, financial services analytical applications infrastructure, flexcube core banking, fusion middleware, health sciences empirica signal, health sciences information manager, insurance policy administration j2ee, insurance rules palette, jdeveloper, primavera p6 enterprise project portfolio management, rapid planning, retail customer management and segmentation foundation, retail integration bus, retail order broker, retail price management, retail xstore point of service, storagetek tape analytics sw tool, utilities framework, webcenter portal, leap, oncommand api services, oncommand workflow automation, snap creator framework, snapcenter, snapmanager, ubuntu linux
Vulnerable Versions:
0, 2.1.0, 9.3.3, 9.3.5, 13.3.0.1, 2.4.0, 12.2.1.3.0, 12.2.1.4.0, 3.9m0p1, 8.0.0, 7.3.0, 7.4.0, 12.6.0, 3.2.0, 11.1.1.9.0, 13.4.0.0, 8.0.6, 11.7.0, 11.8.0, 11.9.0, 11.10.0, 9.0, 3.0.1, 11.1.0, 10.2.0, 10.2.4, 11.0.2, 16.1.0.0, 17.1.0.0, 18.1.0.0, 19.12.0.0, 12.1, 12.2, 16.0, 17.0, 18.0, 19.0, 15.0, 19.1, 14.0.3, 14.1.3.0, 15.0.3.0, 16.0.3.0, 15.0.4, 16.0.6, 17.0.4, 18.0.3, 2.3, 4.3.0.1.0, 2.2.0.0.0, 4.2.0.2.0, 4.2.0.3.0, 4.4.0.0.0, 4.4.0.2.0, 15.1, 16.04
Timeline
Official Publish:
May 1st, 2020
Last Modified:
August 4th, 2024
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.