Vulnerability · Published May 1, 2020 · Assigned by mitre
CVE-2020-10683
Critical 9.8
In plain English
A critical-severity security flaw in the dom4j package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 7.3% (higher than 94% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)7.3%top 5.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | dom4j | 2.1.3-1 | DEBIAN-CVE-2020-10683 |
| Debian:13 | dom4j | 2.1.3-1 | DEBIAN-CVE-2020-10683 |
| Debian:14 | dom4j | 2.1.3-1 | DEBIAN-CVE-2020-10683 |
| Maven | dom4j:dom4j | no fix listed | GHSA-hwj3-m3p6-hj38 |
| Maven | org.dom4j:dom4j | 2.0.3 | GHSA-hwj3-m3p6-hj38 |
| Maven | org.dom4j:dom4j | 2.1.3 | GHSA-hwj3-m3p6-hj38 |
Affected products (as reported)
References
- openSUSE-SU-2020:0719 vendor-advisory, x_refsource_SUSE
- https://www.oracle.com/security-alerts/cpujul2020.html x_refsource_MISC
- https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html x_refsource_MISC
- https://bugzilla.redhat.com/show_bug.cgi?id=1694235 x_refsource_MISC
- https://github.com/dom4j/dom4j/releases/tag/version-2.1.3 x_refsource_CONFIRM
- https://github.com/dom4j/dom4j/commit/a8228522a99a02146106672a34c104adbda5c658 x_refsource_CONFIRM
- https://security.netapp.com/advisory/ntap-20200518-0002/ x_refsource_CONFIRM
- USN-4575-1 vendor-advisory, x_refsource_UBUNTU
- https://www.oracle.com/security-alerts/cpuoct2020.html x_refsource_MISC
- https://github.com/dom4j/dom4j/issues/87 x_refsource_MISC
- https://github.com/dom4j/dom4j/commits/version-2.0.3 x_refsource_MISC
- [velocity-dev] 20201203 Use of external DTDs - CVE-2020-10683 mailing-list, x_refsource_MLIST
- [velocity-dev] 20201203 Re: Use of external DTDs - CVE-2020-10683 mailing-list, x_refsource_MLIST
- https://www.oracle.com/security-alerts/cpujan2021.html x_refsource_MISC
- https://www.oracle.com/security-alerts/cpuApr2021.html x_refsource_MISC
- https://www.oracle.com//security-alerts/cpujul2021.html x_refsource_MISC
- [freemarker-notifications] 20210906 [jira] [Created] (FREEMARKER-190) The jar dom4j has known security issue that Freemarker compiles dependend on it mailing-list, x_refsource_MLIST
- https://www.oracle.com/security-alerts/cpuoct2021.html x_refsource_MISC
- https://www.oracle.com/security-alerts/cpujan2022.html x_refsource_MISC
- https://www.oracle.com/security-alerts/cpujul2022.html x_refsource_MISC