Vulnerability-Lookup

BDU:2020-04038 (CVE-2020-10683)

Vulnerability from fstec – Published: 2020-08-26 – Updated: 2026-02-10 – View on bdu.fstec.ru Fixed

Title

Уязвимость реализации функции new org.dom4j.io.SAXReader() библиотеки для работы с XML, XPath и XSLT dom4j, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

Summary

Уязвимость реализации функции new org.dom4j.io.SAXReader() библиотеки для работы с XML, XPath и XSLT dom4j связана с неверным ограничением XML-ссылок на внешние объекты. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, получить несанкционированный доступ к защищаемой информации

Severity

10.0 (High) CVSS 2.0


                      
                        AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 (Critical) CVSS 3.1


                      
                        CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Injection

Incidents

Being clarified

Remediation

Software update

CWE

CWE-611 - Неверное ограничение XML-ссылок на внешние объекты

Aliases

CVE-2020-10683

References

13 references

URL
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00061.html
https://bugzilla.redhat.com/show_bug.cgi?id=1694235
https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_C…
https://github.com/dom4j/dom4j/commit/a8228522a99a02146106672a34c104adbda5c658
https://github.com/dom4j/dom4j/commits/version-2.0.3
https://github.com/dom4j/dom4j/issues/87
https://github.com/dom4j/dom4j/releases/tag/version-2.1.3
https://security.netapp.com/advisory/ntap-20200518-0002/
https://www.oracle.com/security-alerts/cpujul2020.html
https://www.oracle.com/security-alerts/cpujan2021.html
https://www.oracle.com/security-alerts/cpuoct2020.html
https://поддержка.нппкт.рф/bin/view/ОСнова/Обновления/2.4.2/
https://abf.rosa.ru/advisories/ROSA-SA-2024-2454

Impacted products

34 products from 8 vendors

Vendors

Red Hat, Inc., Oracle Corp., Novell Inc., Сообщество свободного программного обеспечения, АО «НППКТ», АО «НТЦ ИТ РОСА», Google Inc

Products

Red Hat Enterprise Linux, Business Process Management Suite, Oracle Endeca Information Discovery Integrator, WebCenter Portal, Oracle Retail Customer Management and Segmentation Foundation, Oracle Retail Order Broker, Oracle Communications Unified Inventory Management, Red Hat JBoss Fuse, OpenSUSE Leap, Oracle Data Integrator, Utilities Framework, Application Testing Suite, Red Hat Software Collections, JBoss Enterprise Application Platform, Red Hat Single Sign-On, JBoss Enterprise Application Platform Continuous Delivery, Red Hat Descision Manager, Retail Integration Bus, Oracle Agile PLM, Rapid Planning, Financial Services Analytical Applications Infrastructure, Primavera P6 Enterprise Project Portfolio Management, dom4j, Red Hat Process Automation, Communications Diameter Signaling Router, Banking Platform, Communications Application Session Controller, Oracle Health Sciences Empirica Signal, Oracle Retail Price Management Security, Oracle Health Sciences Information Manager, Enterprise Data Quality, ОСОН ОСнова Оnyx (запись в едином реестре российских программ №5913), РОСА ХРОМ (запись в едином реестре российских программ №1607), Android Studio

Versions

7 (Red Hat Enterprise Linux), 12.2.1.3.0 (Business Process Management Suite), 3.2.0 (Oracle Endeca Information Discovery Integrator), 11.1.1.9.0 (WebCenter Portal), 12.2.1.3.0 (WebCenter Portal), 16.0 (Oracle Retail Customer Management and Segmentation Foundation), 17.0 (Oracle Retail Customer Management and Segmentation Foundation), 18.0 (Oracle Retail Customer Management and Segmentation Foundation), 15.0 (Oracle Retail Order Broker), 16.0 (Oracle Retail Order Broker), 7.4.0 (Oracle Communications Unified Inventory Management), 7 (Red Hat JBoss Fuse), 15.1 (OpenSUSE Leap), 12.2.1.3.0 (Oracle Data Integrator), 4.4.0.0.0 (Utilities Framework), 4.2.0.3.0 (Utilities Framework), 4.2.0.2.0 (Utilities Framework), 13.3.0.1 (Application Testing Suite), - (Red Hat Software Collections), 7 (JBoss Enterprise Application Platform), 7 (Red Hat Single Sign-On), - (JBoss Enterprise Application Platform Continuous Delivery), 7.3 (Oracle Communications Unified Inventory Management), 7.4 (Oracle Communications Unified Inventory Management), 7 (Red Hat Descision Manager), 18.0 (Oracle Retail Order Broker), 15.0 (Retail Integration Bus), 16.0 (Retail Integration Bus), 12.2.1.4.0 (WebCenter Portal), 19.0 (Oracle Retail Order Broker), 9.3.3 (Oracle Agile PLM), 9.3.5 (Oracle Agile PLM), 7.3 for RHEL 6 (JBoss Enterprise Application Platform), 7.3 for RHEL 7 (JBoss Enterprise Application Platform), 7.3 for RHEL 8 (JBoss Enterprise Application Platform), 12.1 (Rapid Planning), 12.2 (Rapid Planning), от 8.0.6 до 8.1.0 включительно (Financial Services Analytical Applications Infrastructure), от 17.1.0.0 до 17.12.17.1 включительно (Primavera P6 Enterprise Project Portfolio Management), от 18.1.0.0 до 18.8.19 включительно (Primavera P6 Enterprise Project Portfolio Management), от 16.1.0.0 до 16.2.20.1 включительно (Primavera P6 Enterprise Project Portfolio Management), от 2.0.0 до 2.0.3 (dom4j), от 2.1.о до 2.1.3 (dom4j), 7 (Red Hat Process Automation), от 19.12.0 до 19.12.6 включительно (Primavera P6 Enterprise Project Portfolio Management), 12.2.1.4.0 (Business Process Management Suite), от 8.0.0 до 8.2.2 включительно (Communications Diameter Signaling Router), от 2.4.0 до 2.10.0 включительно (Banking Platform), 2.2.0.0.0 (Utilities Framework), от 4.3.0.1.0 до 4.3.0.6.0 включительно (Utilities Framework), 3.9m0p1 (Communications Application Session Controller), 9.0 (Oracle Health Sciences Empirica Signal), 19.1 (Oracle Retail Order Broker), 14.0.4 (Oracle Retail Price Management Security), 14.1.3.0 (Oracle Retail Price Management Security), 15.0.3.0 (Oracle Retail Price Management Security), 16.0.3.0 (Oracle Retail Price Management Security), 4.4.0.2.0 (Utilities Framework), 19.0 (Oracle Retail Customer Management and Segmentation Foundation), 12.2.1.4.0 (Oracle Data Integrator), 3.0.1 (Oracle Health Sciences Information Manager), 11.1.1.9.0 (Enterprise Data Quality), 12.2.1.3.0 (Enterprise Data Quality), до 2.4.2 (ОСОН ОСнова Оnyx), 12.4 (РОСА ХРОМ), 2025.2.3.9 (Android Studio)

Product types

Operating system, Application software, Network software, Appliance software, Network appliance software

Platforms

Red Hat, Inc. Red Hat Enterprise Linux 7, Novell Inc. OpenSUSE Leap 15.1, АО «НТЦ ИТ РОСА» РОСА ХРОМ 12.4 (запись в едином реестре российских программ №1607)

Mitigations

Использование рекомендаций: Для dom4j: https://github.com/dom4j/dom4j/commit/a8228522a99a02146106672a34c104adbda5c658 https://github.com/dom4j/dom4j/commits/version-2.0.3 https://github.com/dom4j/dom4j/issues/87 https://github.com/dom4j/dom4j/releases/tag/version-2.1.3 Для программных продуктов Red Hat Inc.: https://access.redhat.com/security/cve/cve-2020-10683 Для программных продуктов Oracle Corp.: https://www.oracle.com/security-alerts/cpujul2020.html https://www.oracle.com/security-alerts/cpujan2021.html https://www.oracle.com/security-alerts/cpuoct2020.html Для программных продуктов Novell Inc.: https://lists.opensuse.org/opensuse-security-announce/2020-05/msg00061.html Для ОСОН Основа: Обновление программного обеспечения dom4j до версии 2.1.3-1 Для операционной системы РОСА ХРОМ: https://abf.rosa.ru/advisories/ROSA-SA-2024-2454

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
  "CVSS 3.0": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Red Hat, Inc., Oracle Corp., Novell Inc., \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f, \u0410\u041e \u00ab\u041d\u041f\u041f\u041a\u0422\u00bb, \u0410\u041e \u00ab\u041d\u0422\u0426 \u0418\u0422 \u0420\u041e\u0421\u0410\u00bb, Google Inc",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "7 (Red Hat Enterprise Linux), 12.2.1.3.0 (Business Process Management Suite), 3.2.0 (Oracle Endeca Information Discovery Integrator), 11.1.1.9.0 (WebCenter Portal), 12.2.1.3.0 (WebCenter Portal), 16.0 (Oracle Retail Customer Management and Segmentation Foundation), 17.0 (Oracle Retail Customer Management and Segmentation Foundation), 18.0 (Oracle Retail Customer Management and Segmentation Foundation), 15.0 (Oracle Retail Order Broker), 16.0 (Oracle Retail Order Broker), 7.4.0 (Oracle Communications Unified Inventory Management), 7 (Red Hat JBoss Fuse), 15.1 (OpenSUSE Leap), 12.2.1.3.0 (Oracle Data Integrator), 4.4.0.0.0 (Utilities Framework), 4.2.0.3.0 (Utilities Framework), 4.2.0.2.0 (Utilities Framework), 13.3.0.1 (Application Testing Suite), - (Red Hat Software Collections), 7 (JBoss Enterprise Application Platform), 7 (Red Hat Single Sign-On), - (JBoss Enterprise Application Platform Continuous Delivery), 7.3 (Oracle Communications Unified Inventory Management), 7.4 (Oracle Communications Unified Inventory Management), 7 (Red Hat Descision Manager), 18.0 (Oracle Retail Order Broker), 15.0 (Retail Integration Bus), 16.0 (Retail Integration Bus), 12.2.1.4.0 (WebCenter Portal), 19.0 (Oracle Retail Order Broker), 9.3.3 (Oracle Agile PLM), 9.3.5 (Oracle Agile PLM), 7.3 for RHEL 6 (JBoss Enterprise Application Platform), 7.3 for RHEL 7 (JBoss Enterprise Application Platform), 7.3 for RHEL 8 (JBoss Enterprise Application Platform), 12.1 (Rapid Planning), 12.2 (Rapid Planning), \u043e\u0442 8.0.6 \u0434\u043e 8.1.0 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Financial Services Analytical Applications Infrastructure), \u043e\u0442 17.1.0.0 \u0434\u043e 17.12.17.1 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Primavera P6 Enterprise Project Portfolio Management), \u043e\u0442 18.1.0.0 \u0434\u043e 18.8.19 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Primavera P6 Enterprise Project Portfolio Management), \u043e\u0442 16.1.0.0 \u0434\u043e 16.2.20.1 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Primavera P6 Enterprise Project Portfolio Management), \u043e\u0442 2.0.0 \u0434\u043e 2.0.3 (dom4j), \u043e\u0442 2.1.\u043e \u0434\u043e 2.1.3 (dom4j), 7 (Red Hat Process Automation), \u043e\u0442 19.12.0 \u0434\u043e 19.12.6 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Primavera P6 Enterprise Project Portfolio Management), 12.2.1.4.0 (Business Process Management Suite), \u043e\u0442 8.0.0 \u0434\u043e 8.2.2 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Communications Diameter Signaling Router), \u043e\u0442 2.4.0 \u0434\u043e 2.10.0 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Banking Platform), 2.2.0.0.0 (Utilities Framework), \u043e\u0442 4.3.0.1.0 \u0434\u043e 4.3.0.6.0 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Utilities Framework), 3.9m0p1 (Communications Application Session Controller), 9.0 (Oracle Health Sciences Empirica Signal), 19.1 (Oracle Retail Order Broker), 14.0.4 (Oracle Retail Price Management Security), 14.1.3.0 (Oracle Retail Price Management Security), 15.0.3.0 (Oracle Retail Price Management Security), 16.0.3.0 (Oracle Retail Price Management Security), 4.4.0.2.0 (Utilities Framework), 19.0 (Oracle Retail Customer Management and Segmentation Foundation), 12.2.1.4.0 (Oracle Data Integrator), 3.0.1 (Oracle Health Sciences Information Manager), 11.1.1.9.0 (Enterprise Data Quality), 12.2.1.3.0 (Enterprise Data Quality), \u0434\u043e 2.4.2 (\u041e\u0421\u041e\u041d \u041e\u0421\u043d\u043e\u0432\u0430 \u041enyx), 12.4 (\u0420\u041e\u0421\u0410 \u0425\u0420\u041e\u041c), 2025.2.3.9 (Android Studio)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\n\u0414\u043b\u044f dom4j:\nhttps://github.com/dom4j/dom4j/commit/a8228522a99a02146106672a34c104adbda5c658\nhttps://github.com/dom4j/dom4j/commits/version-2.0.3\nhttps://github.com/dom4j/dom4j/issues/87\nhttps://github.com/dom4j/dom4j/releases/tag/version-2.1.3\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Red Hat Inc.:\nhttps://access.redhat.com/security/cve/cve-2020-10683\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Oracle Corp.:\nhttps://www.oracle.com/security-alerts/cpujul2020.html\nhttps://www.oracle.com/security-alerts/cpujan2021.html\t\nhttps://www.oracle.com/security-alerts/cpuoct2020.html\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Novell Inc.:\nhttps://lists.opensuse.org/opensuse-security-announce/2020-05/msg00061.html\n\n\u0414\u043b\u044f \u041e\u0421\u041e\u041d \u041e\u0441\u043d\u043e\u0432\u0430:\n\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f dom4j \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 2.1.3-1\n\n\u0414\u043b\u044f \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0420\u041e\u0421\u0410 \u0425\u0420\u041e\u041c: https://abf.rosa.ru/advisories/ROSA-SA-2024-2454",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "29.03.2019",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "10.02.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "26.08.2020",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2020-04038",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2020-10683",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Red Hat Enterprise Linux, Business Process Management Suite, Oracle Endeca Information Discovery Integrator, WebCenter Portal, Oracle Retail Customer Management and Segmentation Foundation, Oracle Retail Order Broker, Oracle Communications Unified Inventory Management, Red Hat JBoss Fuse, OpenSUSE Leap, Oracle Data Integrator, Utilities Framework, Application Testing Suite, Red Hat Software Collections, JBoss Enterprise Application Platform, Red Hat Single Sign-On, JBoss Enterprise Application Platform Continuous Delivery, Red Hat Descision Manager, Retail Integration Bus, Oracle Agile PLM, Rapid Planning, Financial Services Analytical Applications Infrastructure, Primavera P6 Enterprise Project Portfolio Management, dom4j, Red Hat Process Automation, Communications Diameter Signaling Router, Banking Platform, Communications Application Session Controller, Oracle Health Sciences Empirica Signal, Oracle Retail Price Management Security, Oracle Health Sciences Information Manager, Enterprise Data Quality, \u041e\u0421\u041e\u041d \u041e\u0421\u043d\u043e\u0432\u0430 \u041enyx (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21165913), \u0420\u041e\u0421\u0410 \u0425\u0420\u041e\u041c (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21161607), Android Studio",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "Red Hat, Inc. Red Hat Enterprise Linux 7 , Novell Inc. OpenSUSE Leap 15.1 , \u0410\u041e \u00ab\u041d\u0422\u0426 \u0418\u0422 \u0420\u041e\u0421\u0410\u00bb \u0420\u041e\u0421\u0410 \u0425\u0420\u041e\u041c 12.4  (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21161607)",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 new org.dom4j.io.SAXReader() \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441 XML, XPath \u0438 XSLT dom4j, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u0432\u0435\u0440\u043d\u043e\u0435 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435 XML-\u0441\u0441\u044b\u043b\u043e\u043a \u043d\u0430 \u0432\u043d\u0435\u0448\u043d\u0438\u0435 \u043e\u0431\u044a\u0435\u043a\u0442\u044b (CWE-611)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 new org.dom4j.io.SAXReader() \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441 XML, XPath \u0438 XSLT dom4j \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0432\u0435\u0440\u043d\u044b\u043c \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435\u043c XML-\u0441\u0441\u044b\u043b\u043e\u043a \u043d\u0430 \u0432\u043d\u0435\u0448\u043d\u0438\u0435 \u043e\u0431\u044a\u0435\u043a\u0442\u044b. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e, \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u0418\u043d\u044a\u0435\u043a\u0446\u0438\u044f",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00061.html \nhttps://bugzilla.redhat.com/show_bug.cgi?id=1694235 \nhttps://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html \nhttps://github.com/dom4j/dom4j/commit/a8228522a99a02146106672a34c104adbda5c658 \nhttps://github.com/dom4j/dom4j/commits/version-2.0.3 \nhttps://github.com/dom4j/dom4j/issues/87 Third Party Advisory \nhttps://github.com/dom4j/dom4j/releases/tag/version-2.1.3 \nhttps://security.netapp.com/advisory/ntap-20200518-0002/\nhttps://www.oracle.com/security-alerts/cpujul2020.html\nhttps://www.oracle.com/security-alerts/cpujan2021.html\t\nhttps://www.oracle.com/security-alerts/cpuoct2020.html\nhttps://\u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430.\u043d\u043f\u043f\u043a\u0442.\u0440\u0444/bin/view/\u041e\u0421\u043d\u043e\u0432\u0430/\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f/2.4.2/\nhttps://abf.rosa.ru/advisories/ROSA-SA-2024-2454",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430, \u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c, \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e, \u041f\u041e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430, \u041f\u041e \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-611",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 10)\n\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 9,8)"
}

CVE-2020-10683 (GCVE-0-2020-10683)

Vulnerability from cvelistv5 – Published: 2020-05-01 18:55 – Updated: 2024-08-04 11:06

Summary

dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

20 references

URL	Tags
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://www.oracle.com/security-alerts/cpujul2020.html	x_refsource_MISC
https://cheatsheetseries.owasp.org/cheatsheets/XM…	x_refsource_MISC
https://bugzilla.redhat.com/show_bug.cgi?id=1694235	x_refsource_MISC
https://github.com/dom4j/dom4j/releases/tag/versi…	x_refsource_CONFIRM
https://github.com/dom4j/dom4j/commit/a8228522a99…	x_refsource_CONFIRM
https://security.netapp.com/advisory/ntap-2020051…	x_refsource_CONFIRM
https://usn.ubuntu.com/4575-1/	vendor-advisoryx_refsource_UBUNTU
https://www.oracle.com/security-alerts/cpuoct2020.html	x_refsource_MISC
https://github.com/dom4j/dom4j/issues/87	x_refsource_MISC
https://github.com/dom4j/dom4j/commits/version-2.0.3	x_refsource_MISC
https://lists.apache.org/thread.html/r51f3f980105…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r91c64cd51e6…	mailing-listx_refsource_MLIST
https://www.oracle.com/security-alerts/cpujan2021.html	x_refsource_MISC
https://www.oracle.com/security-alerts/cpuApr2021.html	x_refsource_MISC
https://www.oracle.com//security-alerts/cpujul2021.html	x_refsource_MISC
https://lists.apache.org/thread.html/rb1b990d7920…	mailing-listx_refsource_MLIST
https://www.oracle.com/security-alerts/cpuoct2021.html	x_refsource_MISC
https://www.oracle.com/security-alerts/cpujan2022.html	x_refsource_MISC
https://www.oracle.com/security-alerts/cpujul2022.html	x_refsource_MISC

Date Public

2020-04-12 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T11:06:11.156Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "openSUSE-SU-2020:0719",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00061.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1694235"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/dom4j/dom4j/releases/tag/version-2.1.3"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/dom4j/dom4j/commit/a8228522a99a02146106672a34c104adbda5c658"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200518-0002/"
          },
          {
            "name": "USN-4575-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4575-1/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/dom4j/dom4j/issues/87"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/dom4j/dom4j/commits/version-2.0.3"
          },
          {
            "name": "[velocity-dev] 20201203 Use of external DTDs - CVE-2020-10683",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r51f3f9801058e47153c0ad9bc6209d57a592fc0e7aefd787760911b8%40%3Cdev.velocity.apache.org%3E"
          },
          {
            "name": "[velocity-dev] 20201203 Re: Use of external DTDs - CVE-2020-10683",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r91c64cd51e68e97d524395474eaa25362d564572276b9917fcbf5c32%40%3Cdev.velocity.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
          },
          {
            "name": "[freemarker-notifications] 20210906 [jira] [Created] (FREEMARKER-190) The jar dom4j has known security issue that Freemarker compiles dependend on it",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rb1b990d7920ae0d50da5109b73b92bab736d46c9788dd4b135cb1a51%40%3Cnotifications.freemarker.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2020-04-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-07-25T16:13:36.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "openSUSE-SU-2020:0719",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00061.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1694235"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/dom4j/dom4j/releases/tag/version-2.1.3"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/dom4j/dom4j/commit/a8228522a99a02146106672a34c104adbda5c658"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200518-0002/"
        },
        {
          "name": "USN-4575-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4575-1/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/dom4j/dom4j/issues/87"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/dom4j/dom4j/commits/version-2.0.3"
        },
        {
          "name": "[velocity-dev] 20201203 Use of external DTDs - CVE-2020-10683",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r51f3f9801058e47153c0ad9bc6209d57a592fc0e7aefd787760911b8%40%3Cdev.velocity.apache.org%3E"
        },
        {
          "name": "[velocity-dev] 20201203 Re: Use of external DTDs - CVE-2020-10683",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r91c64cd51e68e97d524395474eaa25362d564572276b9917fcbf5c32%40%3Cdev.velocity.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
        },
        {
          "name": "[freemarker-notifications] 20210906 [jira] [Created] (FREEMARKER-190) The jar dom4j has known security issue that Freemarker compiles dependend on it",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rb1b990d7920ae0d50da5109b73b92bab736d46c9788dd4b135cb1a51%40%3Cnotifications.freemarker.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-10683",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "openSUSE-SU-2020:0719",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00061.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujul2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
            },
            {
              "name": "https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html",
              "refsource": "MISC",
              "url": "https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1694235",
              "refsource": "MISC",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1694235"
            },
            {
              "name": "https://github.com/dom4j/dom4j/releases/tag/version-2.1.3",
              "refsource": "CONFIRM",
              "url": "https://github.com/dom4j/dom4j/releases/tag/version-2.1.3"
            },
            {
              "name": "https://github.com/dom4j/dom4j/commit/a8228522a99a02146106672a34c104adbda5c658",
              "refsource": "CONFIRM",
              "url": "https://github.com/dom4j/dom4j/commit/a8228522a99a02146106672a34c104adbda5c658"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200518-0002/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200518-0002/"
            },
            {
              "name": "USN-4575-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4575-1/"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
            },
            {
              "name": "https://github.com/dom4j/dom4j/issues/87",
              "refsource": "MISC",
              "url": "https://github.com/dom4j/dom4j/issues/87"
            },
            {
              "name": "https://github.com/dom4j/dom4j/commits/version-2.0.3",
              "refsource": "MISC",
              "url": "https://github.com/dom4j/dom4j/commits/version-2.0.3"
            },
            {
              "name": "[velocity-dev] 20201203 Use of external DTDs - CVE-2020-10683",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r51f3f9801058e47153c0ad9bc6209d57a592fc0e7aefd787760911b8@%3Cdev.velocity.apache.org%3E"
            },
            {
              "name": "[velocity-dev] 20201203 Re: Use of external DTDs - CVE-2020-10683",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r91c64cd51e68e97d524395474eaa25362d564572276b9917fcbf5c32@%3Cdev.velocity.apache.org%3E"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuApr2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
            },
            {
              "name": "https://www.oracle.com//security-alerts/cpujul2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
            },
            {
              "name": "[freemarker-notifications] 20210906 [jira] [Created] (FREEMARKER-190) The jar dom4j has known security issue that Freemarker compiles dependend on it",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rb1b990d7920ae0d50da5109b73b92bab736d46c9788dd4b135cb1a51@%3Cnotifications.freemarker.apache.org%3E"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujul2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-10683",
    "datePublished": "2020-05-01T18:55:25.000Z",
    "dateReserved": "2020-03-20T00:00:00.000Z",
    "dateUpdated": "2024-08-04T11:06:11.156Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

BDU:2020-04038 (CVE-2020-10683)

CVE-2020-10683 (GCVE-0-2020-10683)

Tags

Sightings

Nomenclature

Related by attack behaviour