CVE-2020-10683

Published: May 1, 2020Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.

Affected (79)

Products: Dom4j Project: Dom4j · Oracle: Agile Plm, Application Testing Suite, Banking Platform, Business Process Management Suite, Communications Application Session Controller, Communications Diameter Signaling Router, Communications Unified Inventory Management, Data Integrator, Documaker, Endeca Information Discovery Integrator, Enterprise Data Quality, Enterprise Manager Base Platform, Financial Services Analytical Applications Infrastructure, Flexcube Core Banking, Fusion Middleware, Health Sciences Empirica Signal, Health Sciences Information Manager, Insurance Policy Administration J2ee, Insurance Rules Palette, Jdeveloper, Primavera P6 Enterprise Project Portfolio Management, Rapid Planning, Retail Customer Management And Segmentation Foundation, Retail Integration Bus, Retail Order Broker, Retail Price Management, Retail Xstore Point Of Service, Storagetek Tape Analytics Sw Tool, Utilities Framework, Webcenter Portal · Opensuse: Leap · +2 more

Show all products

Dom4j Project: Dom4j · Oracle: Agile Plm, Application Testing Suite, Banking Platform, Business Process Management Suite, Communications Application Session Controller, Communications Diameter Signaling Router, Communications Unified Inventory Management, Data Integrator, Documaker, Endeca Information Discovery Integrator, Enterprise Data Quality, Enterprise Manager Base Platform, Financial Services Analytical Applications Infrastructure, Flexcube Core Banking, Fusion Middleware, Health Sciences Empirica Signal, Health Sciences Information Manager, Insurance Policy Administration J2ee, Insurance Rules Palette, Jdeveloper, Primavera P6 Enterprise Project Portfolio Management, Rapid Planning, Retail Customer Management And Segmentation Foundation, Retail Integration Bus, Retail Order Broker, Retail Price Management, Retail Xstore Point Of Service, Storagetek Tape Analytics Sw Tool, Utilities Framework, Webcenter Portal · Opensuse: Leap · Netapp: Oncommand Api Services, Oncommand Workflow Automation, Snap Creator Framework, Snapcenter, Snapmanager · Canonical: Ubuntu Linux

1 product

30 products

Application Testing Suite

Banking Platform

Business Process Management Suite

Communications Application Session Controller

Communications Diameter Signaling Router

Communications Unified Inventory Management

Data Integrator

Documaker

Endeca Information Discovery Integrator

Enterprise Data Quality

Enterprise Manager Base Platform

Financial Services Analytical Applications Infrastructure

Flexcube Core Banking

Fusion Middleware

Health Sciences Empirica Signal

Health Sciences Information Manager

Insurance Policy Administration J2ee

Insurance Rules Palette

Jdeveloper

Primavera P6 Enterprise Project Portfolio Management

Rapid Planning

Retail Customer Management And Segmentation Foundation

Retail Integration Bus

Retail Order Broker

Retail Price Management

Retail Xstore Point Of Service

Storagetek Tape Analytics Sw Tool

1 product

5 products

Oncommand Api Services

Oncommand Workflow Automation

Snap Creator Framework

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Dom4j Project Dom4j	Before 2.0.3
Dom4j Project Dom4j	From 2.1.0 to 2.1.3

Configuration B

69 vulnerable

Vulnerable Software	Affected Versions
Oracle Agile Plm	Version 9.3.3
Oracle Agile Plm	Version 9.3.5
Oracle Application Testing Suite	Version 13.3.0.1
Oracle Banking Platform	From 2.4.0 to 2.10.0
Oracle Business Process Management Suite	Version 12.2.1.3.0
Oracle Business Process Management Suite	Version 12.2.1.4.0
Oracle Communications Application Session Controller	Version 3.9m0p1
Oracle Communications Diameter Signaling Router	From 8.0.0 to 8.2.2
Oracle Communications Unified Inventory Management	Version 7.3.0
Oracle Communications Unified Inventory Management	Version 7.4.0
Oracle Data Integrator	Version 12.2.1.3.0
Oracle Data Integrator	Version 12.2.1.4.0
Oracle Documaker	From 12.6.0 to 12.6.4
Oracle Endeca Information Discovery Integrator	Version 3.2.0
Oracle Enterprise Data Quality	Version 11.1.1.9.0
Oracle Enterprise Data Quality	Version 12.2.1.3.0
Oracle Enterprise Manager Base Platform	Version 13.4.0.0
Oracle Financial Services Analytical Applications Infrastructure	From 8.0.6 to 8.1.0
Oracle Flexcube Core Banking	Version 11.10.0
Oracle Flexcube Core Banking	Version 11.7.0
Oracle Flexcube Core Banking	Version 11.8.0
Oracle Flexcube Core Banking	Version 11.9.0
Oracle Fusion Middleware	Version 12.2.1.4.0
Oracle Health Sciences Empirica Signal	Version 9.0
Oracle Health Sciences Information Manager	Version 3.0.1
Oracle Insurance Policy Administration J2ee	From 11.1.0 to 11.3.0
Oracle Insurance Policy Administration J2ee	Version 10.2.0
Oracle Insurance Policy Administration J2ee	Version 10.2.4
Oracle Insurance Policy Administration J2ee	Version 11.0.2
Oracle Insurance Rules Palette	From 11.1.0 to 11.3.0
Oracle Insurance Rules Palette	Version 10.2.0
Oracle Insurance Rules Palette	Version 10.2.4
Oracle Insurance Rules Palette	Version 11.0.2
Oracle Jdeveloper	Version 12.2.1.4.0
Oracle Primavera P6 Enterprise Project Portfolio Management	From 16.1.0.0 to 16.2.20.1
Oracle Primavera P6 Enterprise Project Portfolio Management	From 17.1.0.0 to 17.12.17.1
Oracle Primavera P6 Enterprise Project Portfolio Management	From 18.1.0.0 to 18.8.19.0
Oracle Primavera P6 Enterprise Project Portfolio Management	From 19.12.0.0 to 19.12.6.0
Oracle Rapid Planning	Version 12.1
Oracle Rapid Planning	Version 12.2
Oracle Retail Customer Management And Segmentation Foundation	Version 16.0
Oracle Retail Customer Management And Segmentation Foundation	Version 17.0
Oracle Retail Customer Management And Segmentation Foundation	Version 18.0
Oracle Retail Customer Management And Segmentation Foundation	Version 19.0
Oracle Retail Integration Bus	Version 15.0
Oracle Retail Integration Bus	Version 16.0
Oracle Retail Order Broker	Version 15.0
Oracle Retail Order Broker	Version 16.0
Oracle Retail Order Broker	Version 18.0
Oracle Retail Order Broker	Version 19.0
Oracle Retail Order Broker	Version 19.1
Oracle Retail Price Management	Version 14.0.3
Oracle Retail Price Management	Version 14.1.3.0
Oracle Retail Price Management	Version 15.0.3.0
Oracle Retail Price Management	Version 16.0.3.0
Oracle Retail Xstore Point Of Service	Version 15.0.4
Oracle Retail Xstore Point Of Service	Version 16.0.6
Oracle Retail Xstore Point Of Service	Version 17.0.4
Oracle Retail Xstore Point Of Service	Version 18.0.3
Oracle Storagetek Tape Analytics Sw Tool	Version 2.3
Oracle Utilities Framework	From 4.3.0.1.0 to 4.3.0.6.0
Oracle Utilities Framework	Version 2.2.0.0.0
Oracle Utilities Framework	Version 4.2.0.2.0
Oracle Utilities Framework	Version 4.2.0.3.0
Oracle Utilities Framework	Version 4.4.0.0.0
Oracle Utilities Framework	Version 4.4.0.2.0
Oracle Webcenter Portal	Version 11.1.1.9.0
Oracle Webcenter Portal	Version 12.2.1.3.0
Oracle Webcenter Portal	Version 12.2.1.4.0

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Opensuse Leap	Version 15.1

Configuration D

6 vulnerable

Vulnerable Software	Affected Versions
Netapp Oncommand Api Services	All versions
Netapp Oncommand Workflow Automation	All versions
Netapp Snap Creator Framework	All versions
Netapp Snapcenter	All versions
Netapp Snapmanager	All versions
Netapp Snapmanager	All versions

Configuration E

1 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 16.04

Related CWEs

CWE-611

Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (40)

http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00061.html

Source: cve@mitre.org

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1694235

Source: cve@mitre.org

Issue TrackingPatchThird Party Advisory

https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html

Source: cve@mitre.org

Third Party Advisory

https://github.com/dom4j/dom4j/commit/a8228522a99a02146106672a34c104adbda5c658

Source: cve@mitre.org

PatchThird Party Advisory

https://github.com/dom4j/dom4j/commits/version-2.0.3

Source: cve@mitre.org

PatchThird Party Advisory

https://github.com/dom4j/dom4j/issues/87

Source: cve@mitre.org

Third Party Advisory

https://github.com/dom4j/dom4j/releases/tag/version-2.1.3

Source: cve@mitre.org

Release NotesThird Party Advisory

https://lists.apache.org/thread.html/r51f3f9801058e47153c0ad9bc6209d57a592fc0e7aefd787760911b8%40%3Cdev.velocity.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/r91c64cd51e68e97d524395474eaa25362d564572276b9917fcbf5c32%40%3Cdev.velocity.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/rb1b990d7920ae0d50da5109b73b92bab736d46c9788dd4b135cb1a51%40%3Cnotifications.freemarker.apache.org%3E

Source: cve@mitre.org

https://security.netapp.com/advisory/ntap-20200518-0002/

Source: cve@mitre.org

Third Party Advisory

https://usn.ubuntu.com/4575-1/

Source: cve@mitre.org

Third Party Advisory

https://www.oracle.com//security-alerts/cpujul2021.html

Source: cve@mitre.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuApr2021.html

Source: cve@mitre.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2021.html

Source: cve@mitre.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2022.html

Source: cve@mitre.org

Third Party Advisory

https://www.oracle.com/security-alerts/cpujul2020.html

Source: cve@mitre.org

Third Party Advisory

https://www.oracle.com/security-alerts/cpujul2022.html

Source: cve@mitre.org

https://www.oracle.com/security-alerts/cpuoct2020.html

Source: cve@mitre.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuoct2021.html

Source: cve@mitre.org

PatchThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00061.html