dom4j allows External Entities by default which might enable XXE attacks

CRÍTICO 9.8CVE-2020-10683 · GHSA-hwj3-m3p6-hj38 · Published 01/05/2020 · updated 25/08/2026

En resumen

CVE-2020-10683 es una vulnerabilidad CRÍTICO (CVSS 9.8) que afecta a dom4j:dom4j, org.dom4j:dom4j, dom4j (dom4j project).
Probabilidad de explotación en los próximos 30 días (EPSS): 7.3%, mayor que el 94.4% de las vulnerabilidades.
Solución: actualizar a 2.1.3, 2.0.3 o posterior.

Package	Affected versions	Patched versions
dom4j:dom4j Maven	`≤ 1.6.1`	No fix yet
org.dom4j:dom4j Maven	`≥ 2.1.0, < 2.1.3< 2.0.3`	`2.1.32.0.3`
dom4j dom4j_project	`≥ 2.1.0, < 2.1.3< 2.0.3`	`2.1.32.0.3`
agile product lifecycle management oracle	`= 9.3.3= 9.3.5`	No fix yet
application testing suite oracle	`= 13.3.0.1`	No fix yet
banking platform oracle	`≥ 2.4.0, ≤ 2.10.0`	No fix yet
business process management suite oracle	`= 12.2.1.3.0= 12.2.1.4.0`	No fix yet
communications application session controller oracle	`= 3.9m0p1`	No fix yet
communications diameter signaling router oracle	`≥ 8.0.0, ≤ 8.2.2`	No fix yet
communications unified inventory management oracle	`= 7.3.0= 7.4.0`	No fix yet
data integrator oracle	`= 12.2.1.3.0= 12.2.1.4.0`	No fix yet
documaker oracle	`≥ 12.6.0, ≤ 12.6.4`	No fix yet
endeca information discovery integrator oracle	`= 3.2.0`	No fix yet
enterprise data quality oracle	`= 11.1.1.9.0= 12.2.1.3.0`	No fix yet
enterprise manager base platform oracle	`= 13.4.0.0`	No fix yet
financial services analytical applications infrastructure oracle	`≥ 8.0.6, ≤ 8.1.0`	No fix yet
flexcube core banking oracle	`= 11.10.0= 11.7.0= 11.8.0= 11.9.0`	No fix yet
fusion middleware oracle	`= 12.2.1.4.0`	No fix yet
health sciences empirica signal oracle	`= 9.0`	No fix yet
health sciences information manager oracle	`= 3.0.1`	No fix yet
insurance policy administration j2ee oracle	`= 10.2.0= 10.2.4= 11.0.2≥ 11.1.0, ≤ 11.3.0`	No fix yet
insurance rules palette oracle	`= 10.2.0= 10.2.4= 11.0.2≥ 11.1.0, ≤ 11.3.0`	No fix yet
jdeveloper oracle	`= 12.2.1.4.0`	No fix yet
primavera p6 enterprise project portfolio management oracle	`≥ 16.1.0.0, ≤ 16.2.20.1≥ 17.1.0.0, ≤ 17.12.17.1≥ 18.1.0.0, ≤ 18.8.19.0≥ 19.12.0.0, ≤ 19.12.6.0`	No fix yet
rapid planning oracle	`= 12.1= 12.2`	No fix yet
retail customer management and segmentation foundation oracle	`= 16.0= 17.0= 18.0= 19.0`	No fix yet
retail integration bus oracle	`= 15.0= 16.0`	No fix yet
retail order broker oracle	`= 15.0= 16.0= 18.0= 19.0= 19.1`	No fix yet
retail price management oracle	`= 14.0.3= 14.1.3.0= 15.0.3.0= 16.0.3.0`	No fix yet
retail xstore point of service oracle	`= 15.0.4= 16.0.6= 17.0.4= 18.0.3`	No fix yet
storagetek tape analytics sw tool oracle	`= 2.3`	No fix yet
utilities framework oracle	`= 2.2.0.0.0= 4.2.0.2.0= 4.2.0.3.0= 4.4.0.0.0= 4.4.0.2.0≥ 4.3.0.1.0, ≤ 4.3.0.6.0`	No fix yet
webcenter portal oracle	`= 11.1.1.9.0= 12.2.1.3.0= 12.2.1.4.0`	No fix yet

Description

dom4j before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.

Note: This advisory applies to dom4j:dom4j version 1.x legacy artifacts. To resolve this a change to the latest version of org.dom4j:dom4j is recommended.

NVD description

dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.

References

nvd.nist.gov/vuln/detail/CVE-2020-10683 · ADVISORY
dom4j/dom4j · WEB
dom4j/dom4j commit 1707bf3 · WEB
dom4j/dom4j commit a822852 · WEB
oracle.com/security-alerts/cpuoct2021.html · WEB
oracle.com/security-alerts/cpuoct2020.html · WEB
oracle.com/security-alerts/cpujul2022.html · WEB
oracle.com/security-alerts/cpujul2020.html · WEB
oracle.com/security-alerts/cpujan2022.html · WEB
oracle.com/security-alerts/cpujan2021.html · WEB
oracle.com/security-alerts/cpuApr2021.html · WEB
oracle.com//security-alerts/cpujul2021.html

Más vulnerabilidades de dom4j:dom4j

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free