CVEvulnerability

CVE-2020-10683

9.8 CRITICAL Published 2020-05-01 Modified 2026-08-25 Official page ↗
Status
Modified
Published
2020-05-01
Last modified
2026-08-25
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-611

Description

dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.

Affected configurations

• dom4j project dom4j (< 2.0.3) • dom4j project dom4j (>= 2.1.0 < 2.1.3) • oracle agile product lifecycle management 9.3.3 • oracle agile product lifecycle management 9.3.5 • oracle application testing suite 13.3.0.1 • oracle banking platform (>= 2.4.0 <= 2.10.0) • oracle business process management suite 12.2.1.3.0 • oracle business process management suite 12.2.1.4.0 • oracle communications application session controller 3.9m0p1 • oracle communications diameter signaling router (>= 8.0.0 <= 8.2.2) • oracle communications unified inventory management 7.3.0 • oracle communications unified inventory management 7.4.0 • oracle data integrator 12.2.1.3.0 • oracle data integrator 12.2.1.4.0 • oracle documaker (>= 12.6.0 <= 12.6.4) • oracle endeca information discovery integrator 3.2.0 • oracle enterprise data quality 11.1.1.9.0 • oracle enterprise data quality 12.2.1.3.0 • oracle enterprise manager base platform 13.4.0.0 • oracle financial services analytical applications infrastructure (>= 8.0.6 <= 8.1.0) • oracle flexcube core banking 11.7.0 • oracle flexcube core banking 11.8.0 • oracle flexcube core banking 11.9.0 • oracle flexcube core banking 11.10.0 • oracle fusion middleware 12.2.1.4.0 • oracle health sciences empirica signal 9.0 • oracle health sciences information manager 3.0.1 • oracle insurance policy administration j2ee (>= 11.1.0 <= 11.3.0) • oracle insurance policy administration j2ee 10.2.0 • oracle insurance policy administration j2ee 10.2.4 • oracle insurance policy administration j2ee 11.0.2 • oracle insurance rules palette (>= 11.1.0 <= 11.3.0) • oracle insurance rules palette 10.2.0 • oracle insurance rules palette 10.2.4 • oracle insurance rules palette 11.0.2 • oracle jdeveloper 12.2.1.4.0 • oracle primavera p6 enterprise project portfolio management (>= 16.1.0.0 <= 16.2.20.1) • oracle primavera p6 enterprise project portfolio management (>= 17.1.0.0 <= 17.12.17.1) • oracle primavera p6 enterprise project portfolio management (>= 18.1.0.0 <= 18.8.19.0) • oracle primavera p6 enterprise project portfolio management (>= 19.12.0.0 <= 19.12.6.0) • oracle rapid planning 12.1 • oracle rapid planning 12.2 • oracle retail customer management and segmentation foundation 16.0 • oracle retail customer management and segmentation foundation 17.0 • oracle retail customer management and segmentation foundation 18.0 • oracle retail customer management and segmentation foundation 19.0 • oracle retail integration bus 15.0 • oracle retail integration bus 16.0 • oracle retail order broker 15.0 • oracle retail order broker 16.0 • oracle retail order broker 18.0 • oracle retail order broker 19.0 • oracle retail order broker 19.1 • oracle retail price management 14.0.3 • oracle retail price management 14.1.3.0 • oracle retail price management 15.0.3.0 • oracle retail price management 16.0.3.0 • oracle retail xstore point of service 15.0.4 • oracle retail xstore point of service 16.0.6 • oracle retail xstore point of service 17.0.4 … and 18 more

Related

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References