CVE-2020-10683

Katalog CVE

CVSS 9.8 · Critical EPSS 7,3%

Kerentanan Improper Restriction of XML External Entity Reference pada dom4j project dom4j, oracle agile product lifecycle management +26 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.

Rincian

Terbit di NVD

1 Mei 2020

Terakhir diubah

25 Agustus 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-611: Improper Restriction of XML External Entity Reference

EPSS (30 hari)

7,3% peluang dieksploitasi; lebih tinggi dari 94,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 78 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

• https://bugzilla.redhat.com/show_bug.cgi?id=1694235 issue tracking · patch · advisory pihak ketiga
• https://github.com/dom4j/dom4j/commit/a8228522a99a02146106672a34c104adbda5c658 patch · advisory pihak ketiga
• https://github.com/dom4j/dom4j/commits/version-2.0.3 patch · advisory pihak ketiga
• https://www.oracle.com//security-alerts/cpujul2021.html patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpuApr2021.html patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpujan2021.html patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpuoct2020.html patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpuoct2021.html patch · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00061.html advisory pihak ketiga
• https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html advisory pihak ketiga
• https://github.com/dom4j/dom4j/issues/87 advisory pihak ketiga
• https://github.com/dom4j/dom4j/releases/tag/version-2.1.3 release notes · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20200518-0002/ advisory pihak ketiga
• https://usn.ubuntu.com/4575-1/ advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpujan2022.html advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpujul2020.html advisory pihak ketiga
• https://lists.apache.org/thread.html/r51f3f9801058e47153c0ad9bc6209d57a592fc0e7aefd787760911b8%40%3Cdev.veloci...
• https://lists.apache.org/thread.html/r91c64cd51e68e97d524395474eaa25362d564572276b9917fcbf5c32%40%3Cdev.veloci...
• https://lists.apache.org/thread.html/rb1b990d7920ae0d50da5109b73b92bab736d46c9788dd4b135cb1a51%40%3Cnotificati...
• https://www.oracle.com/security-alerts/cpujul2022.html