GHSA-hwj3-m3p6-hj38
dom4j allows External Entities by default which might enable XXE attacks
At a glance
- Published
- Updated
- CVE
- CVE-2020-10683
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
dom4j before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j. Note: This advisory applies to `dom4j:dom4j` version 1.x legacy artifacts. To resolve this a change to the latest version of `org.dom4j:dom4j` is recommended.
Affected packages
| Package | Versions |
|---|---|
| Maven · org.dom4j:dom4j | introduced 0, fixed 2.0.3 |
| Maven · org.dom4j:dom4j | introduced 2.1.0, fixed 2.1.3 |
| Maven · dom4j:dom4j | introduced 0, last affected 1.6.1 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-10683 ADVISORY
- https://github.com/dom4j/dom4j/issues/87 WEB
- https://github.com/dom4j/dom4j/commit/1707bf3d898a8ada3b213acb0e3b38f16eaae73d WEB
- https://github.com/dom4j/dom4j/commit/a8228522a99a02146106672a34c104adbda5c658 WEB
- https://www.oracle.com/security-alerts/cpuoct2021.html WEB
- https://www.oracle.com/security-alerts/cpuoct2020.html WEB
- https://www.oracle.com/security-alerts/cpujul2022.html WEB
- https://www.oracle.com/security-alerts/cpujul2020.html WEB
- https://www.oracle.com/security-alerts/cpujan2022.html WEB
- https://www.oracle.com/security-alerts/cpujan2021.html WEB
- https://www.oracle.com/security-alerts/cpuApr2021.html WEB
- https://www.oracle.com//security-alerts/cpujul2021.html WEB
- https://usn.ubuntu.com/4575-1 WEB
- https://security.netapp.com/advisory/ntap-20200518-0002 WEB
- https://lists.apache.org/thread.html/rb1b990d7920ae0d50da5109b73b92bab736d46c9788dd4b135cb1a51@%3Cnotifications.freemarker.apache.org%3E WEB
- https://lists.apache.org/thread.html/r91c64cd51e68e97d524395474eaa25362d564572276b9917fcbf5c32@%3Cdev.velocity.apache.org%3E WEB
- https://lists.apache.org/thread.html/r51f3f9801058e47153c0ad9bc6209d57a592fc0e7aefd787760911b8@%3Cdev.velocity.apache.org%3E WEB
- https://github.com/dom4j/dom4j/releases/tag/version-2.1.3 WEB
- https://github.com/dom4j/dom4j/commits/version-2.0.3 WEB
- https://github.com/dom4j/dom4j PACKAGE
- https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=1694235 WEB
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00061.html WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |