GitHub Advisoryadvisory · Maven

GHSA-hwj3-m3p6-hj38 dom4j allows External Entities by default which might enable XXE attacks

CRITICAL Published 2020-06-05 Modified 2022-02-08 Official page ↗
Aliases
CVE-2020-10683
Ecosystem
Maven
Packages
org.dom4j:dom4j, dom4j:dom4j
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-611
Reviewed
2020-06-04

Affected packages

• Maven org.dom4j:dom4j: < 2.0.3 → fixed in 2.0.3 • Maven org.dom4j:dom4j: >= 2.1.0, < 2.1.3 → fixed in 2.1.3 • Maven dom4j:dom4j: <= 1.6.1 (no fix yet)

Description

dom4j before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j. Note: This advisory applies to `dom4j:dom4j` version 1.x legacy artifacts. To resolve this a change to the latest version of `org.dom4j:dom4j` is recommended.

Related

Alias · CVE (1)

  • CVE-2020-10683 dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References