critical
CVE-2020-10683
dom4j: XML External Entity vulnerability in default SAX parser
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat7.4CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
Trivy's own label is CRITICAL. Rated critical by NVD, GHSA. Rated lower by Red Hat (medium), Ubuntu (medium).
Description
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| maven::GitHub Security Advisory Maven | dom4j:dom4j, org.dom4j:dom4j | 2.0.3, 2.1.3 |
| debian 10 | dom4j | no fix listed |
| debian 11 | dom4j | 2.1.3-1 |
| debian 12 | dom4j | 2.1.3-1 |
| debian 13 | dom4j | 2.1.3-1 |
| debian 14 | dom4j | 2.1.3-1 |
| debian 8 | dom4j | 1.6.1+dfsg.3-2+deb8u2 |
| debian 9 | dom4j | no fix listed |
| echo | dom4j | 2.1.3-1 |
| Red Hat | candlepin, candlepin-selinux, dom4j and 9 more | no fix listed |
| ubuntu 16.04 | dom4j | 1.6.1+dfsg.3-2ubuntu1.1 |
| ubuntu 16.04-ESM | dom4j | 1.6.1+dfsg.3-2ubuntu1.1 |
Show all 26 entries from 14 sources
| Source | Package | Fixed in |
|---|---|---|
| maven::GitHub Security Advisory Maven | dom4j:dom4j | no fix listed |
| maven::GitHub Security Advisory Maven | org.dom4j:dom4j | 2.0.3, 2.1.3 |
| debian 10 | dom4j | no fix listed |
| debian 11 | dom4j | 2.1.3-1 |
| debian 12 | dom4j | 2.1.3-1 |
| debian 13 | dom4j | 2.1.3-1 |
| debian 14 | dom4j | 2.1.3-1 |
| debian 8 | dom4j | 1.6.1+dfsg.3-2+deb8u2 |
| debian 9 | dom4j | no fix listed |
| echo | dom4j | 2.1.3-1 |
| Red Hat | candlepin | no fix listed |
| Red Hat | candlepin-selinux | no fix listed |
| Red Hat | dom4j | no fix listed |
| Red Hat | dom4j-demo | no fix listed |
| Red Hat | dom4j-javadoc | no fix listed |
| Red Hat | dom4j-manual | no fix listed |
| Red Hat | rh-java-common-dom4j | no fix listed |
| Red Hat | rh-java-common-dom4j-demo | no fix listed |
| Red Hat | rh-java-common-dom4j-javadoc | no fix listed |
| Red Hat | rh-java-common-dom4j-manual | no fix listed |
| Red Hat | rh-maven35-dom4j | no fix listed |
| Red Hat | rh-maven35-dom4j-javadoc | no fix listed |
| ubuntu 16.04 | dom4j | 1.6.1+dfsg.3-2ubuntu1.1 |
| ubuntu 16.04-ESM | dom4j | 1.6.1+dfsg.3-2ubuntu1.1 |
| ubuntu 18.04-ESM | dom4j | no fix listed |
| ubuntu 20.04-ESM | dom4j | no fix listed |
References
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00061.html
- https://access.redhat.com/security/cve/CVE-2020-10683
- https://bugzilla.redhat.com/show_bug.cgi?id=1694235
- https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
- https://github.com/dom4j/dom4j
- https://github.com/dom4j/dom4j/commit/1707bf3d898a8ada3b213acb0e3b38f16eaae73d
- https://github.com/dom4j/dom4j/commit/a8228522a99a02146106672a34c104adbda5c658
- https://github.com/dom4j/dom4j/commits/version-2.0.3
All 28 references
- https://github.com/dom4j/dom4j/issues/87
- https://github.com/dom4j/dom4j/releases/tag/version-2.1.3
- https://lists.apache.org/thread.html/r51f3f9801058e47153c0ad9bc6209d57a592fc0e7aefd787760911b8@%3Cdev.velocity.apache.org%3E
- https://lists.apache.org/thread.html/r91c64cd51e68e97d524395474eaa25362d564572276b9917fcbf5c32@%3Cdev.velocity.apache.org%3E
- https://lists.apache.org/thread.html/rb1b990d7920ae0d50da5109b73b92bab736d46c9788dd4b135cb1a51@%3Cnotifications.freemarker.apache.org%3E
- https://nvd.nist.gov/vuln/detail/CVE-2020-10683
- https://security.netapp.com/advisory/ntap-20200518-0002
- https://security.netapp.com/advisory/ntap-20200518-0002/
- https://ubuntu.com/security/notices/USN-4575-1
- https://usn.ubuntu.com/4575-1
- https://usn.ubuntu.com/4575-1/
- https://www.cve.org/CVERecord?id=CVE-2020-10683
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.oracle.com/security-alerts/cpuoct2021.html