Skip to content
OpenAdvisories
Critical USN-4575-1 1 CVE

dom4j vulnerability

Published Oct 13, 2020 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that dom4j incorrectly handled reading XML data. A
remote attacker could exploit this with a crafted XML file to expose
sensitive data or possibly execute arbitrary code. (CVE-2020-10683)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 16.04 LTS 16.04:LTS dom4j 1.6.1+dfsg.3-2ubuntu1.1

Vulnerabilities 1

  • Critical 9.8
    CVE-2020-10683

    dom4j allows External Entities by default which might enable XXE attacks

    dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any applicatio…

    dom4j:dom4j dom4j dom4j org.dom4j:dom4j Debian Ubuntu Maven

References

  • report
    https://ubuntu.com/security/CVE-2020-10683