Home > Vulnerability Database > CVE-2020-10683

Mend.io Vulnerability Database

CVE-2020-10683

Good to know:

Date: May 1, 2020

dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.

Language: Java

Severity Score

9.8

Related Resources (30)

Url: https://lists.apache.org/thread.html/r51f3f9801058e47153c0ad9bc6209d57a592fc0e7aefd787760911b8%40%3Cdev.velocity.apache.org%3E

Url: https://lists.apache.org/thread.html/r91c64cd51e68e97d524395474eaa25362d564572276b9917fcbf5c32%40%3Cdev.velocity.apache.org%3E

Url: https://www.oracle.com/security-alerts/cpuApr2021.html

Url: https://www.oracle.com/security-alerts/cpuoct2020.html

Url: https://nvd.nist.gov/vuln/detail/CVE-2020-10683

Url: https://github.com/dom4j/dom4j/commit/a8228522a99a02146106672a34c104adbda5c658

Url: https://usn.ubuntu.com/4575-1

Url: https://lists.apache.org/thread.html/rb1b990d7920ae0d50da5109b73b92bab736d46c9788dd4b135cb1a51%40%3Cnotifications.freemarker.apache.org%3E

Url: https://www.oracle.com/security-alerts/cpujan2021.html

Url: https://www.oracle.com/security-alerts/cpujan2022.html

Url: https://github.com/dom4j/dom4j/commits/version-2.0.3

Url: https://access.redhat.com/security/cve/CVE-2020-10683

Url: https://www.oracle.com/security-alerts/cpujul2020.html

Url: https://lists.apache.org/thread.html/r51f3f9801058e47153c0ad9bc6209d57a592fc0e7aefd787760911b8@%3Cdev.velocity.apache.org%3E

Url: https://www.oracle.com/security-alerts/cpuoct2021.html

Url: https://security.netapp.com/advisory/ntap-20200518-0002

Url: https://usn.ubuntu.com/4575-1/

Url: https://github.com/dom4j/dom4j/releases/tag/version-2.1.3

Url: https://github.com/dom4j/dom4j

Url: https://lists.apache.org/thread.html/rb1b990d7920ae0d50da5109b73b92bab736d46c9788dd4b135cb1a51@%3Cnotifications.freemarker.apache.org%3E

Url: https://github.com/dom4j/dom4j/issues/87

Url: https://github.com/dom4j/dom4j/commit/1707bf3d898a8ada3b213acb0e3b38f16eaae73d

Url: https://bugzilla.redhat.com/show_bug.cgi?id=1694235

Url: https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html

Url: https://lists.apache.org/thread.html/r91c64cd51e68e97d524395474eaa25362d564572276b9917fcbf5c32@%3Cdev.velocity.apache.org%3E

Url: http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00061.html

Url: https://www.oracle.com//security-alerts/cpujul2021.html

Url: https://security.netapp.com/advisory/ntap-20200518-0002/

Url: https://www.oracle.com/security-alerts/cpujul2022.html

Url: https://www.mend.io/vulnerability-database/CVE-2020-10683

Severity Score

9.8

Weakness Type (CWE)

Improper Restriction of XML External Entity Reference ('XXE')

CWE-611

Top Fix

Upgrade Version

Upgrade to version org.dom4j:dom4j:2.1.3,org.dom4j:dom4j:2.0.3

Learn More

CVSS v3.1

Base Score:	9.8
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	HIGH
Integrity (I):	HIGH
Availability (A):	HIGH

CVSS v2

Base Score:	7.5
Access Vector (AV):	NETWORK
Access Complexity (AC):	LOW
Authentication (AU):	NONE
Confidentiality (C):	PARTIAL
Integrity (I):	PARTIAL
Availability (A):	PARTIAL
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2020-10683

Good to know:

Date: May 1, 2020

Language: Java

Severity Score

Related Resources (30)

Severity Score

Weakness Type (CWE)

Top Fix

Upgrade Version

CVSS v3.1

CVSS v2

Do you need more information?