logo

Database

XML injection (XXE) In dom4j:dom4j

Description

dom4j allows External Entities by default which might enable XXE attacks dom4j before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.

Note: This advisory applies to dom4j:dom4j version 1.x legacy artifacts. To resolve this a change to the latest version of org.dom4j:dom4j is recommended.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2020-106832. NVD-2020-106833. OSV-2020-106834. OSV-DEBIAN-2020-106835. GCVE-2020-106836. SECURITY-TRACKER-CVE-2020-10683

References

1. https://github.com/dom4j/dom4j/issues/872. https://github.com/dom4j/dom4j/commit/1707bf3d898a8ada3b213acb0e3b38f16eaae73d3. https://github.com/dom4j/dom4j/commit/a8228522a99a02146106672a34c104adbda5c6584. https://www.oracle.com/security-alerts/cpuoct2021.html5. https://www.oracle.com/security-alerts/cpuoct2020.html6. https://www.oracle.com/security-alerts/cpujul2022.html7. https://www.oracle.com/security-alerts/cpujul2020.html8. https://www.oracle.com/security-alerts/cpujan2022.html9. https://www.oracle.com/security-alerts/cpujan2021.html10. https://www.oracle.com/security-alerts/cpuApr2021.html11. https://www.oracle.com//security-alerts/cpujul2021.html12. https://usn.ubuntu.com/4575-113. https://security.netapp.com/advisory/ntap-20200518-000214. https://lists.apache.org/thread.html/rb1b990d7920ae0d50da5109b73b92bab736d46c9788dd4b135cb1a51@%3Cnotifications.freemarker.apache.org%3E15. https://lists.apache.org/thread.html/r91c64cd51e68e97d524395474eaa25362d564572276b9917fcbf5c32@%3Cdev.velocity.apache.org%3E16. https://lists.apache.org/thread.html/r51f3f9801058e47153c0ad9bc6209d57a592fc0e7aefd787760911b8@%3Cdev.velocity.apache.org%3E17. https://github.com/dom4j/dom4j/releases/tag/version-2.1.318. https://github.com/dom4j/dom4j/commits/version-2.0.319. https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html20. https://bugzilla.redhat.com/show_bug.cgi?id=169423521. http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00061.html

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.