CVE-2020-10683

Fixed in a distro release EPSS 7%

dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.

Published 2020-05-01 · CVE record · OSV

Products: dom4j_project dom4j, oracle agile_product_lifecycle_management, oracle application_testing_suite, oracle banking_platform, oracle business_process_management_suite, oracle communications_application_session_controller, oracle communications_diameter_signaling_router, oracle communications_unified_inventory_management, oracle data_integrator, oracle documaker, oracle endeca_information_discovery_integrator, oracle enterprise_data_quality, oracle enterprise_manager_base_platform, oracle financial_services_analytical_applications_infrastructure, Oracle FLEXCUBE Core Banking, oracle fusion_middleware, oracle health_sciences_empirica_signal, oracle health_sciences_information_manager, oracle insurance_policy_administration_j2ee, oracle insurance_rules_palette, oracle jdeveloper, oracle primavera_p6_enterprise_project_portfolio_management, oracle rapid_planning, oracle retail_customer_management_and_segmentation_foundation, oracle retail_integration_bus, oracle retail_order_broker, oracle retail_price_management, oracle retail_xstore_point_of_service, oracle storagetek_tape_analytics_sw_tool, oracle utilities_framework, oracle webcenter_portal, opensuse leap, netapp oncommand_api_services, netapp oncommand_workflow_automation, netapp snap_creator_framework, netapp snapcenter, netapp snapmanager, canonical ubuntu_linux

Fixed upstream

Distro releases