What’s Vulnerable › Vulnerabilities
CVE-2020-10683
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 7.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2020-05-01 · updated 2026-08-25
- Weakness: CWE-611
Description
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.
Affected products
- Canonical Ubuntu Linux: 16.04
- Dom4J Project Dom4J: before 2.0.3; from 2.1.0 before 2.1.3 — fixed in 2.0.3, 2.1.3
- NetApp Oncommand Api Services: all versions
- NetApp OnCommand Workflow Automation: all versions
- NetApp Snap Creator Framework: all versions
- NetApp SnapCenter: all versions
- SnapManager for Oracle: all versions
- openSUSE Leap: 15.1
- Oracle Corporation Oracle Agile PLM: 9.3.3, 9.3.5
- Oracle Corporation Oracle Application Testing Suite: 13.3.0.1
- Oracle Banking Platform: from 2.4.0 through 2.10.0
- Oracle Corporation Oracle Business Process Management Suite: 12.2.1.3.0, 12.2.1.4.0
- Oracle Communications Application Session Controller: 3.9m0p1
- Oracle Corporation Communications Diameter Signaling Router (DSR): from 8.0.0 through 8.2.2
- Oracle Corporation Oracle Communications Unified Inventory Management: 7.3.0, 7.4.0
- Oracle Corporation Oracle Data Integrator: 12.2.1.3.0, 12.2.1.4.0
- Oracle Documaker: from 12.6.0 through 12.6.4
- Oracle Corporation Endeca Information Discovery Integrator: 3.2.0
- Oracle Corporation Enterprise Data Quality: 11.1.1.9.0, 12.2.1.3.0
- Oracle Corporation Enterprise Manager Base Platform: 13.4.0.0
- Oracle Corporation Financial Services Analytical Applications Infrastructure: from 8.0.6 through 8.1.0
- Oracle FLEXCUBE Core Banking: 11.7.0, 11.8.0, 11.9.0, 11.10.0
- Oracle Corporation Oracle Enterprise Manager for Fusion Middleware: 12.2.1.4.0
- Oracle Health Sciences Empirica Signal: 9.0
- Oracle Health Sciences Information Manager: 3.0.1
- Oracle Insurance Policy Administration J2Ee: from 11.1.0 through 11.3.0; 10.2.0, 10.2.4, 11.0.2
- Oracle Insurance Rules Palette: from 11.1.0 through 11.3.0; 10.2.0, 10.2.4, 11.0.2
- Oracle Corporation Oracle JDeveloper: 12.2.1.4.0
- Oracle Corporation Primavera P6 Enterprise Project Portfolio Management: from 16.1.0.0 through 16.2.20.1; from 17.1.0.0 through 17.12.17.1; from 18.1.0.0 through 18.8.19.0; from 19.12.0.0 through 19.12.6.0
- Oracle Corporation Rapid Planning: 12.1, 12.2
How to fix
Upgrade to a fixed version: Dom4J Project Dom4J 2.0.3, 2.1.3. Check the vendor advisory for mitigations.
References
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00061.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1694235
- https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
- https://github.com/dom4j/dom4j/commit/a8228522a99a02146106672a34c104adbda5c658
- https://github.com/dom4j/dom4j/commits/version-2.0.3
- https://github.com/dom4j/dom4j/issues/87
- https://github.com/dom4j/dom4j/releases/tag/version-2.1.3
- https://lists.apache.org/thread.html/r51f3f9801058e47153c0ad9bc6209d57a592fc0e7aefd787760911b8%40%3Cdev.velocity.apache.org%3E
- https://lists.apache.org/thread.html/r91c64cd51e68e97d524395474eaa25362d564572276b9917fcbf5c32%40%3Cdev.velocity.apache.org%3E
- https://lists.apache.org/thread.html/rb1b990d7920ae0d50da5109b73b92bab736d46c9788dd4b135cb1a51%40%3Cnotifications.freemarker.apache.org%3E
- https://security.netapp.com/advisory/ntap-20200518-0002/
- https://usn.ubuntu.com/4575-1/
Get alerted when CVE-2020-10683 or the next vulnerability affects your stack