What is the CVSS score of CVE-2018-1000632?

CVE-2018-1000632 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 6.6%.

Is there a public PoC exploit available for CVE-2018-1000632?

Yes, a public proof-of-concept exploit is available for CVE-2018-1000632. Prioritise patching immediately. EPSS: 6.6%.

Is there a patch available for CVE-2018-1000632?

Yes, a patch is available for CVE-2018-1000632. Update the affected software to the latest version immediately.

Dom4J CVE-2018-1000632

HIGH

XML Injection (aka Blind XPath Injection) (CWE-91)

2018-08-20 cve@mitre.org

Code Injection Dom4J Debian Linux Flexcube Investor Servicing Primavera P6 Enterprise Project Portfolio Management Rapid Planning Retail Integration Bus Utilities Framework Satellite Satellite Capsule Jboss Enterprise Application Platform Oncommand Workflow Automation Snap Creator Framework Snapcenter Snapmanager

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

CVE Published

Aug 20, 2018 - 19:31 nvd

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

19,918 maven packages depend on dom4j:dom4j (1,558 direct, 18,556 indirect)
188 maven packages depend on org.dom4j:dom4j (50 direct, 139 indirect)

Ecosystem-wide dependent count for version 1.6.1 and other introduced versions.

DescriptionNVD

dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or elements in the XML document. This vulnerability appears to have been fixed in 2.1.1 or later.

AnalysisAI

dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified under CWE-91. dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or elements in the XML document. This vulnerability appears to have been fixed in 2.1.1 or later. Affected products include: Dom4J Project Dom4J, Debian Debian Linux, Oracle Flexcube Investor Servicing, Oracle Primavera P6 Enterprise Project Portfolio Management, Oracle Rapid Planning. Version information: version 2.1.1.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.