NetSight
IP …
critical9.8

CVE-2020-10683

dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks.

Impact

dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.

Affected products

VendorProductAffected versions
Dom4j ProjectDom4j
before 2.0.3
from 2.1.0 before 2.1.3
OracleAgile Product Lifecycle Management
Versions 9.3.3, 9.3.5
OracleApplication Testing Suite
Version 13.3.0.1
OracleBanking Platform
from 2.4.0 through 2.10.0
OracleBusiness Process Management Suite
Versions 12.2.1.3.0, 12.2.1.4.0
OracleCommunications Application Session Controller
Version 3.9m0p1
OracleCommunications Diameter Signaling Router
from 8.0.0 through 8.2.2
OracleCommunications Unified Inventory Management
Versions 7.3.0, 7.4.0
OracleData Integrator
Versions 12.2.1.3.0, 12.2.1.4.0
OracleDocumaker
from 12.6.0 through 12.6.4
OracleEndeca Information Discovery Integrator
Version 3.2.0
OracleEnterprise Data Quality
Versions 11.1.1.9.0, 12.2.1.3.0

Weakness classification

CWE-611

References