Critical severity · published May 1, 2020
CVE-2020-10683
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks
9.8
CVSS
7.3%
EPSS
No
On KEV
Description
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)7.3% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FM
Fusion Middleware · Oracle
12.2.1.4.0 · source: NVD
AP
Agile Product Lifecycle Management · Oracle
9.3.3; 9.3.5 · source: NVD
AT
Application Testing Suite · Oracle
13.3.0.1 · source: NVD
BP
Banking Platform · Oracle
2.4.0 through 2.10.0 · source: NVD
BP
Business Process Management Suite · Oracle
12.2.1.3.0; 12.2.1.4.0 · source: NVD
CA
Communications Application Session Controller · Oracle
3.9m0p1 · source: NVD
CD
Communications Diameter Signaling Router · Oracle
8.0.0 through 8.2.2 · source: NVD
CU
Communications Unified Inventory Management · Oracle
7.3.0; 7.4.0 · source: NVD
DI
Data Integrator · Oracle
12.2.1.3.0; 12.2.1.4.0 · source: NVD
DO
Documaker · Oracle
12.6.0 through 12.6.4 · source: NVD
DO
Dom4j · Dom4j Project
before 2.0.3; 2.1.0 before 2.1.3 · source: NVD
EI
Endeca Information Discovery Integrator · Oracle
3.2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-10683
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-10683
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00061.html
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1694235
Third Party Advisory
https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
Patch
https://github.com/dom4j/dom4j/commit/a8228522a99a02146106672a34c104adbda5c658
Patch
https://github.com/dom4j/dom4j/commits/version-2.0.3
Third Party Advisory
https://github.com/dom4j/dom4j/issues/87
More from Fusion Middleware
9.8
CVE-2025-61757
Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability
9.8
CVE-2021-35587
Oracle Fusion Middleware Unspecified Vulnerability
9.8
CVE-2020-2551
Oracle Fusion Middleware Unspecified Vulnerability
9.8
CVE-2012-1710
Oracle Fusion Middleware Unspecified Vulnerability
9.1
CVE-2012-3152
Oracle Fusion Middleware Unspecified Vulnerability