NetSight
IP …
high7.5

CVE-2018-1000632

dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element.

Impact

dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or elements in the XML document. This vulnerability appears to have been fixed in 2.1.1 or later.

Affected products

VendorProductAffected versions
Dom4j ProjectDom4j
from 2.0.0 before 2.0.3
from 2.1.0 before 2.1.1
DebianDebian Linux
Version 8.0
OracleFlexcube Investor Servicing
Versions 12.0.4, 12.1.0, 12.3.0, 12.4.0, 14.0.0
OraclePrimavera P6 Enterprise Project Portfolio Management
from 16.1.0.0 through 16.2.20.1
from 17.1.0.0 through 17.12.17.1
from 18.1.0.0 through 18.8.19.0
from 19.12.0.0 through 19.12.6.0
OracleRapid Planning
Versions 12.1, 12.2
OracleRetail Integration Bus
Versions 15.0, 16.0
OracleUtilities Framework
from 4.3.0.2.0 through 4.3.0.6.0
Versions 2.2.0, 4.2.0.2.0, 4.2.0.3.0, 4.4.0.0.0, 4.4.0.2
RedhatSatellite
Version 6.6
RedhatSatellite Capsule
Version 6.6
RedhatJboss Enterprise Application Platform
Versions 6.0.0, 6.4.0, 7.1.0
NetappOncommand Workflow Automation
All versions
NetappSnap Creator Framework
All versions

Weakness classification

CWE-91

References