What is the CVSS score of CVE-2020-10683?

CVE-2020-10683 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 7.3%.

Is there a patch available for CVE-2020-10683?

Yes, a patch is available for CVE-2020-10683. Update the affected software to the latest version immediately.

Leap CVE-2020-10683

CRITICAL

Improper Restriction of XML External Entity Reference (CWE-611)

2020-05-01 cve@mitre.org

XXE Oracle Canonical Leap Oncommand Workflow Automation Snapmanager Ubuntu Linux Utilities Framework Primavera P6 Enterprise Project Portfolio Management Snapcenter Application Testing Suite Communications Application Session Controller Financial Services Analytical Applications Infrastructure Jdeveloper Retail Customer Management And Segmentation Foundation Snap Creator Framework Opensuse Fusion Middleware Storagetek Tape Analytics Sw Tool Agile Plm Communications Diameter Signaling Router Endeca Information Discovery Integrator Retail Order Broker Retail Price Management Retail Xstore Point Of Service Business Process Management Suite Banking Platform Enterprise Manager Base Platform Insurance Policy Administration J2Ee Webcenter Portal Communications Unified Inventory Management Data Integrator Insurance Rules Palette Documaker Health Sciences Information Manager Retail Integration Bus Flexcube Core Banking Oncommand Api Services Enterprise Data Quality Rapid Planning Dom4J Health Sciences Empirica Signal Netapp

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

May 01, 2020 - 19:15 nvd

CRITICAL 9.8

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

19,979 maven packages depend on dom4j:dom4j (1,566 direct, 18,609 indirect)
188 maven packages depend on org.dom4j:dom4j (50 direct, 139 indirect)

Ecosystem-wide dependent count for version 1.6.1 and other introduced versions.

DescriptionNVD

dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.

AnalysisAI

dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This XML External Entity (XXE) vulnerability could allow attackers to read arbitrary files or perform SSRF through XML processing.

Technical ContextAI

This vulnerability is classified as XML External Entity (XXE) (CWE-611), which allows attackers to read arbitrary files or perform SSRF through XML processing. dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j. Affected products include: Dom4J Project Dom4J, Oracle Agile Plm, Oracle Application Testing Suite, Oracle Banking Platform, Oracle Business Process Management Suite. Version information: before 2.0.3.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Disable external entity processing in XML parsers, use JSON instead of XML where possible.