CVE-2020-10683
Publicada em · Atualizada em
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 7.3%
probabilidade de exploração
7.3%top 6% das CVEs
exploração observada
nãonenhuma fonte reporta
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.
Produtos afetados
n/a · n/aReferências
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00061.htmlhttps://bugzilla.redhat.com/show_bug.cgi?id=1694235https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.htmlhttps://github.com/dom4j/dom4j/commit/a8228522a99a02146106672a34c104adbda5c658https://github.com/dom4j/dom4j/commits/version-2.0.3https://github.com/dom4j/dom4j/issues/87https://github.com/dom4j/dom4j/releases/tag/version-2.1.3https://lists.apache.org/thread.html/r51f3f9801058e47153c0ad9bc6209d57a592fc0e7aefd787760911b8%40%3Cdev.velocity.apache.org%3Ehttps://lists.apache.org/thread.html/r91c64cd51e68e97d524395474eaa25362d564572276b9917fcbf5c32%40%3Cdev.velocity.apache.org%3Ehttps://lists.apache.org/thread.html/rb1b990d7920ae0d50da5109b73b92bab736d46c9788dd4b135cb1a51%40%3Cnotifications.freemarker.apache.org%3Ehttps://security.netapp.com/advisory/ntap-20200518-0002/https://usn.ubuntu.com/4575-1/