What is the CVSS score of CVE-2020-10683?

CVE-2020-10683 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 7.3%.

Is there a patch available for CVE-2020-10683?

Yes, a patch is available for CVE-2020-10683. Update the affected software to the latest version immediately.

Dom4J CVE-2020-10683

CRITICAL

Improper Restriction of XML External Entity Reference (CWE-611)

2020-05-01 cve@mitre.org

XXE Dom4J Agile Plm Application Testing Suite Banking Platform Business Process Management Suite Communications Application Session Controller Communications Diameter Signaling Router Communications Unified Inventory Management Data Integrator Documaker Endeca Information Discovery Integrator Enterprise Data Quality Enterprise Manager Base Platform Financial Services Analytical Applications Infrastructure Flexcube Core Banking Fusion Middleware Health Sciences Empirica Signal Health Sciences Information Manager Insurance Policy Administration J2Ee Insurance Rules Palette Jdeveloper Primavera P6 Enterprise Project Portfolio Management Rapid Planning Retail Customer Management And Segmentation Foundation Retail Integration Bus Retail Order Broker Retail Price Management Retail Xstore Point Of Service Storagetek Tape Analytics Sw Tool Utilities Framework Webcenter Portal Leap Oncommand Api Services Oncommand Workflow Automation Snap Creator Framework Snapcenter Snapmanager Ubuntu Linux

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

May 01, 2020 - 19:15 nvd

CRITICAL 9.8

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

19,918 maven packages depend on dom4j:dom4j (1,558 direct, 18,556 indirect)
188 maven packages depend on org.dom4j:dom4j (50 direct, 139 indirect)

Ecosystem-wide dependent count for version 1.6.1 and other introduced versions.

DescriptionNVD

dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.

AnalysisAI

dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This XML External Entity (XXE) vulnerability could allow attackers to read arbitrary files or perform SSRF through XML processing.

Technical ContextAI

This vulnerability is classified as XML External Entity (XXE) (CWE-611), which allows attackers to read arbitrary files or perform SSRF through XML processing. dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j. Affected products include: Dom4J Project Dom4J, Oracle Agile Plm, Oracle Application Testing Suite, Oracle Banking Platform, Oracle Business Process Management Suite. Version information: before 2.0.3.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Disable external entity processing in XML parsers, use JSON instead of XML where possible.