Skip to content
OpenAdvisories
Critical DLA-2191-1 1 CVE

dom4j - security update

Published Apr 29, 2020 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 8 dom4j 1.6.1+dfsg.3-2+deb8u2

Vulnerabilities 1

  • Critical 9.8
    CVE-2020-10683

    dom4j allows External Entities by default which might enable XXE attacks

    dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any applicatio…

    dom4j:dom4j dom4j dom4j org.dom4j:dom4j Debian Ubuntu Maven