CVE-2020-10683
CRITICAL 9.8
En bref
- Source
- NVD
- EPSS
- EPSS 7.27 % · centile 94 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- mitre
- Statut NVD
- Modified
Description
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.
Faiblesses (CWE)
- CWE-611 — Entité externe XML (XXE)
Références
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00061.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1694235
- https://github.com/dom4j/dom4j/releases/tag/version-2.1.3
- https://github.com/dom4j/dom4j/commit/a8228522a99a02146106672a34c104adbda5c658
- https://security.netapp.com/advisory/ntap-20200518-0002/
- https://usn.ubuntu.com/4575-1/
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://github.com/dom4j/dom4j/issues/87
- https://github.com/dom4j/dom4j/commits/version-2.0.3
- https://lists.apache.org/thread.html/r51f3f9801058e47153c0ad9bc6209d57a592fc0e7aefd787760911b8%40%3Cdev.velocity.apache.org%3E
- https://lists.apache.org/thread.html/r91c64cd51e68e97d524395474eaa25362d564572276b9917fcbf5c32%40%3Cdev.velocity.apache.org%3E
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://lists.apache.org/thread.html/rb1b990d7920ae0d50da5109b73b92bab736d46c9788dd4b135cb1a51%40%3Cnotifications.freemarker.apache.org%3E
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | HIGH 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-hwj3-m3p6-hj38 — dom4j allows External Entities by default which might enable XXE attacks
Références européennes
- ENISA EUVD · EUVD-2020-0492
- GCVE · GCVE-0-2020-10683
Avis du CERT-FR
- CERTFR-2026-AVI-1165 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0556 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0262 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2021-AVI-943 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2021-AVI-770 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
- CERTFR-2021-AVI-560 — Multiples vulnérabilités dans Oracle Systems · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:dom4j_project:dom4j:*:*:*:*:*:*:*:*< 2.0.3cpe:2.3:a:dom4j_project:dom4j:*:*:*:*:*:*:*:*≥ 2.1.0 < 2.1.3cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.3:*:*:*:*:*:*:*cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.5:*:*:*:*:*:*:*cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:banking_platform:*:*:*:*:*:*:*:*≥ 2.4.0 ≤ 2.10.0cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:business_process_management_suite:12.2.1.4.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_application_session_controller:3.9m0p1:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*≥ 8.0.0 ≤ 8.2.2cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:data_integrator:12.2.1.3.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:data_integrator:12.2.1.4.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:documaker:*:*:*:*:*:*:*:*≥ 12.6.0 ≤ 12.6.4cpe:2.3:a:oracle:endeca_information_discovery_integrator:3.2.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:enterprise_data_quality:11.1.1.9.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:enterprise_data_quality:12.2.1.3.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*≥ 8.0.6 ≤ 8.1.0cpe:2.3:a:oracle:flexcube_core_banking:11.7.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:flexcube_core_banking:11.8.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:flexcube_core_banking:11.9.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:flexcube_core_banking:11.10.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:fusion_middleware:12.2.1.4.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:health_sciences_empirica_signal:9.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:health_sciences_information_manager:3.0.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:insurance_policy_administration_j2ee:*:*:*:*:*:*:*:*≥ 11.1.0 ≤ 11.3.0cpe:2.3:a:oracle:insurance_policy_administration_j2ee:10.2.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:insurance_policy_administration_j2ee:10.2.4:*:*:*:*:*:*:*cpe:2.3:a:oracle:insurance_policy_administration_j2ee:11.0.2:*:*:*:*:*:*:*cpe:2.3:a:oracle:insurance_rules_palette:*:*:*:*:*:*:*:*≥ 11.1.0 ≤ 11.3.0cpe:2.3:a:oracle:insurance_rules_palette:10.2.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:insurance_rules_palette:10.2.4:*:*:*:*:*:*:*cpe:2.3:a:oracle:insurance_rules_palette:11.0.2:*:*:*:*:*:*:*cpe:2.3:a:oracle:jdeveloper:12.2.1.4.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:*:*:*:*:*:*:*:*≥ 16.1.0.0 ≤ 16.2.20.1cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:*:*:*:*:*:*:*:*≥ 17.1.0.0 ≤ 17.12.17.1cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:*:*:*:*:*:*:*:*≥ 18.1.0.0 ≤ 18.8.19.0cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:*:*:*:*:*:*:*:*≥ 19.12.0.0 ≤ 19.12.6.0- +39 autres
Produits affectés
| Produit | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |