CVE-2020-10683 Security Details

CVE ID

CVE-2020-10683

CWE

CWE-611

CVE Description

dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.

Published

Apr 16, 2020

CVSS Score & Severity

9.8Critical

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

6.960%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

org/dom4j/DocumentHelper.parseText(Ljava/lang/String;)Lorg/dom4j/Document;

JVMVulnerable params: 0

Affected Ecosystems

affected

Source

National Vulnerability Database

References

Red Hat · Bugzilla #1694235THIRD_PARTY