CVE-2020-10683
CRITICAL 9.8
At a glance
- Source
- NVD
- EPSS
- EPSS 7.27 % · percentile 94 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- mitre
- NVD status
- Modified
Description
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.
Weaknesses (CWE)
- CWE-611 — XML External Entity (XXE)
References
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00061.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1694235
- https://github.com/dom4j/dom4j/releases/tag/version-2.1.3
- https://github.com/dom4j/dom4j/commit/a8228522a99a02146106672a34c104adbda5c658
- https://security.netapp.com/advisory/ntap-20200518-0002/
- https://usn.ubuntu.com/4575-1/
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://github.com/dom4j/dom4j/issues/87
- https://github.com/dom4j/dom4j/commits/version-2.0.3
- https://lists.apache.org/thread.html/r51f3f9801058e47153c0ad9bc6209d57a592fc0e7aefd787760911b8%40%3Cdev.velocity.apache.org%3E
- https://lists.apache.org/thread.html/r91c64cd51e68e97d524395474eaa25362d564572276b9917fcbf5c32%40%3Cdev.velocity.apache.org%3E
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://lists.apache.org/thread.html/rb1b990d7920ae0d50da5109b73b92bab736d46c9788dd4b135cb1a51%40%3Cnotifications.freemarker.apache.org%3E
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | HIGH 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-hwj3-m3p6-hj38 — dom4j allows External Entities by default which might enable XXE attacks
European references
- ENISA EUVD · EUVD-2020-0492
- GCVE · GCVE-0-2020-10683
CERT-FR advisories
- CERTFR-2026-AVI-1165 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0556 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0262 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2021-AVI-943 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2021-AVI-770 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
- CERTFR-2021-AVI-560 — Multiples vulnérabilités dans Oracle Systems · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:dom4j_project:dom4j:*:*:*:*:*:*:*:*< 2.0.3cpe:2.3:a:dom4j_project:dom4j:*:*:*:*:*:*:*:*≥ 2.1.0 < 2.1.3cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.3:*:*:*:*:*:*:*cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.5:*:*:*:*:*:*:*cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:banking_platform:*:*:*:*:*:*:*:*≥ 2.4.0 ≤ 2.10.0cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:business_process_management_suite:12.2.1.4.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_application_session_controller:3.9m0p1:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*≥ 8.0.0 ≤ 8.2.2cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:data_integrator:12.2.1.3.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:data_integrator:12.2.1.4.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:documaker:*:*:*:*:*:*:*:*≥ 12.6.0 ≤ 12.6.4cpe:2.3:a:oracle:endeca_information_discovery_integrator:3.2.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:enterprise_data_quality:11.1.1.9.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:enterprise_data_quality:12.2.1.3.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*≥ 8.0.6 ≤ 8.1.0cpe:2.3:a:oracle:flexcube_core_banking:11.7.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:flexcube_core_banking:11.8.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:flexcube_core_banking:11.9.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:flexcube_core_banking:11.10.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:fusion_middleware:12.2.1.4.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:health_sciences_empirica_signal:9.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:health_sciences_information_manager:3.0.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:insurance_policy_administration_j2ee:*:*:*:*:*:*:*:*≥ 11.1.0 ≤ 11.3.0cpe:2.3:a:oracle:insurance_policy_administration_j2ee:10.2.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:insurance_policy_administration_j2ee:10.2.4:*:*:*:*:*:*:*cpe:2.3:a:oracle:insurance_policy_administration_j2ee:11.0.2:*:*:*:*:*:*:*cpe:2.3:a:oracle:insurance_rules_palette:*:*:*:*:*:*:*:*≥ 11.1.0 ≤ 11.3.0cpe:2.3:a:oracle:insurance_rules_palette:10.2.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:insurance_rules_palette:10.2.4:*:*:*:*:*:*:*cpe:2.3:a:oracle:insurance_rules_palette:11.0.2:*:*:*:*:*:*:*cpe:2.3:a:oracle:jdeveloper:12.2.1.4.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:*:*:*:*:*:*:*:*≥ 16.1.0.0 ≤ 16.2.20.1cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:*:*:*:*:*:*:*:*≥ 17.1.0.0 ≤ 17.12.17.1cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:*:*:*:*:*:*:*:*≥ 18.1.0.0 ≤ 18.8.19.0cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:*:*:*:*:*:*:*:*≥ 19.12.0.0 ≤ 19.12.6.0- +39 more
Affected products
| Product | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |