Critical severity9.8NVD Advisory· Published May 1, 2020· Updated Jun 17, 2026

CVE-2020-10683

Description

dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.dom4j:dom4jMaven	< 2.0.3	2.0.3
org.dom4j:dom4jMaven	>= 2.1.0, < 2.1.3	2.1.3
dom4j:dom4jMaven	<= 1.6.1	—

Affected products

Dom4j Project/Dom4j
cpe:2.3:a:dom4j_project:dom4j:*:*:*:*:*:*:*:*
Range: <2.0.3
NetApp/Oncommand API Services
cpe:2.3:a:netapp:oncommand_api_services:-:*:*:*:*:*:*:*
NetApp/Oncommand Workflow Automation
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
NetApp/Snap Creator Framework
cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*
NetApp/Snapcenter
cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*
NetApp/Snapmanager2 versions
cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:oracle:*:*+ 1 more
- cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:oracle:*:*
- cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:*
Oracle Corporation/Agile Plm2 versions
cpe:2.3:a:oracle:agile_plm:9.3.3:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:agile_plm:9.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:agile_plm:9.3.5:*:*:*:*:*:*:*
Oracle Corporation/Application Testing Suite
cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*
Oracle Corporation/Banking Platform
cpe:2.3:a:oracle:banking_platform:*:*:*:*:*:*:*:*
Range: >=2.4.0,<=2.10.0
Oracle Corporation/Business Process Management Suite2 versions
cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:business_process_management_suite:12.2.1.4.0:*:*:*:*:*:*:*
Oracle Corporation/Communications Application Session Controller
cpe:2.3:a:oracle:communications_application_session_controller:3.9m0p1:*:*:*:*:*:*:*
Oracle Corporation/Communications Diameter Signaling Router
cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*
Range: >=8.0.0,<=8.2.2
Oracle Corporation/Communications Unified Inventory Management2 versions
cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:*
Oracle Corporation/Data Integrator2 versions
cpe:2.3:a:oracle:data_integrator:12.2.1.3.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:data_integrator:12.2.1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:data_integrator:12.2.1.4.0:*:*:*:*:*:*:*
Oracle Corporation/Documaker
cpe:2.3:a:oracle:documaker:*:*:*:*:*:*:*:*
Range: >=12.6.0,<=12.6.4
Oracle Corporation/Endeca Information Discovery Integrator
cpe:2.3:a:oracle:endeca_information_discovery_integrator:3.2.0:*:*:*:*:*:*:*
Oracle Corporation/Enterprise Data Quality2 versions
cpe:2.3:a:oracle:enterprise_data_quality:11.1.1.9.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:enterprise_data_quality:11.1.1.9.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:enterprise_data_quality:12.2.1.3.0:*:*:*:*:*:*:*
Oracle Corporation/Enterprise Manager Base Platform
cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:*
Oracle Corporation/Financial Services Analytical Applications Infrastructure
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*
Range: >=8.0.6,<=8.1.0
Oracle Corporation/Flexcube Core Banking4 versions
cpe:2.3:a:oracle:flexcube_core_banking:11.10.0:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:oracle:flexcube_core_banking:11.10.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:flexcube_core_banking:11.7.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:flexcube_core_banking:11.8.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:flexcube_core_banking:11.9.0:*:*:*:*:*:*:*
Oracle Corporation/Fusion Middleware
cpe:2.3:a:oracle:fusion_middleware:12.2.1.4.0:*:*:*:*:*:*:*
Oracle Corporation/Health Sciences Empirica Signal
cpe:2.3:a:oracle:health_sciences_empirica_signal:9.0:*:*:*:*:*:*:*
Oracle Corporation/Health Sciences Information Manager
cpe:2.3:a:oracle:health_sciences_information_manager:3.0.1:*:*:*:*:*:*:*
Oracle Corporation/Insurance Policy Administration J2ee4 versions
cpe:2.3:a:oracle:insurance_policy_administration_j2ee:*:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:oracle:insurance_policy_administration_j2ee:*:*:*:*:*:*:*:*range: >=11.1.0,<=11.3.0
- cpe:2.3:a:oracle:insurance_policy_administration_j2ee:10.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:insurance_policy_administration_j2ee:10.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:insurance_policy_administration_j2ee:11.0.2:*:*:*:*:*:*:*
Oracle Corporation/Insurance Rules Palette4 versions
cpe:2.3:a:oracle:insurance_rules_palette:*:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:oracle:insurance_rules_palette:*:*:*:*:*:*:*:*range: >=11.1.0,<=11.3.0
- cpe:2.3:a:oracle:insurance_rules_palette:10.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:insurance_rules_palette:10.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:insurance_rules_palette:11.0.2:*:*:*:*:*:*:*
Oracle Corporation/Jdeveloper
cpe:2.3:a:oracle:jdeveloper:12.2.1.4.0:*:*:*:*:*:*:*
Oracle Corporation/Primavera P6 Enterprise Project Portfolio Management
cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:*:*:*:*:*:*:*:*
Range: >=16.1.0.0,<=16.2.20.1
Oracle Corporation/Rapid Planning2 versions
cpe:2.3:a:oracle:rapid_planning:12.1:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:rapid_planning:12.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:rapid_planning:12.2:*:*:*:*:*:*:*
Oracle Corporation/Retail Customer Management And Segmentation Foundation4 versions
cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:16.0:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:16.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:17.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:18.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:19.0:*:*:*:*:*:*:*
Oracle Corporation/Retail Integration Bus2 versions
cpe:2.3:a:oracle:retail_integration_bus:15.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:retail_integration_bus:15.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_integration_bus:16.0:*:*:*:*:*:*:*
Oracle Corporation/Retail Order Broker5 versions
cpe:2.3:a:oracle:retail_order_broker:15.0:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:a:oracle:retail_order_broker:15.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_order_broker:16.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_order_broker:18.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_order_broker:19.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_order_broker:19.1:*:*:*:*:*:*:*
Oracle Corporation/Retail Price Management4 versions
cpe:2.3:a:oracle:retail_price_management:14.0.3:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:oracle:retail_price_management:14.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_price_management:14.1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_price_management:15.0.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_price_management:16.0.3.0:*:*:*:*:*:*:*
Oracle Corporation/Retail Xstore Point Of Service4 versions
cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0.4:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:*
Oracle Corporation/Storagetek Tape Analytics Sw Tool
cpe:2.3:a:oracle:storagetek_tape_analytics_sw_tool:2.3:*:*:*:*:*:*:*
Oracle Corporation/Utilities Framework6 versions
cpe:2.3:a:oracle:utilities_framework:*:*:*:*:*:*:*:*+ 5 more
- cpe:2.3:a:oracle:utilities_framework:*:*:*:*:*:*:*:*range: >=4.3.0.1.0,<=4.3.0.6.0
- cpe:2.3:a:oracle:utilities_framework:2.2.0.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:utilities_framework:4.2.0.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:utilities_framework:4.2.0.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:utilities_framework:4.4.0.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:utilities_framework:4.4.0.2.0:*:*:*:*:*:*:*
Oracle Corporation/Webcenter Portal3 versions
cpe:2.3:a:oracle:webcenter_portal:11.1.1.9.0:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:oracle:webcenter_portal:11.1.1.9.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*
Canonical/Ubuntu Linux
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
OpenSUSE/Leap
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
dom4j/dom4jdescription
ghsa-coords6 versions
pkg:maven/dom4j/dom4j pkg:maven/org.dom4j/dom4j pkg:rpm/opensuse/dom4j&distro=openSUSE%20Leap%2015.1 pkg:rpm/opensuse/dom4j&distro=openSUSE%20Tumbleweed pkg:rpm/suse/dom4j&distro=SUSE%20Manager%20Server%203.2 pkg:rpm/suse/dom4j&distro=SUSE%20Manager%20Server%20Module%204.0
<= 1.6.1+ 5 more
- (no CPE)range: <= 1.6.1
- (no CPE)range: < 2.0.3
- (no CPE)range: < 1.6.1-lp151.6.3.1
- (no CPE)range: < 1.6.1-33.6
- (no CPE)range: < 1.6.1-27.7.2
- (no CPE)range: < 1.6.1-4.9.4

Patches

Vulnerability mechanics

References

bugzilla.redhat.com/show_bug.cginvdIssue TrackingPatchThird Party AdvisoryWEB
github.com/dom4j/dom4j/commit/a8228522a99a02146106672a34c104adbda5c658nvdPatchThird Party AdvisoryWEB
github.com/dom4j/dom4j/commits/version-2.0.3nvdPatchThird Party AdvisoryWEB
www.oracle.com//security-alerts/cpujul2021.htmlnvdPatchThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpuApr2021.htmlnvdPatchThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpujan2021.htmlnvdPatchThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpuoct2020.htmlnvdPatchThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpuoct2021.htmlnvdPatchThird Party AdvisoryWEB
lists.opensuse.org/opensuse-security-announce/2020-05/msg00061.htmlnvdThird Party AdvisoryWEB
cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.htmlnvdThird Party AdvisoryWEB
github.com/advisories/GHSA-hwj3-m3p6-hj38ghsaADVISORY
github.com/dom4j/dom4j/issues/87nvdThird Party AdvisoryWEB
github.com/dom4j/dom4j/releases/tag/version-2.1.3nvdRelease NotesThird Party AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2020-10683ghsaADVISORY
security.netapp.com/advisory/ntap-20200518-0002/nvdThird Party Advisory
usn.ubuntu.com/4575-1/nvdThird Party Advisory
www.oracle.com/security-alerts/cpujan2022.htmlnvdThird Party AdvisoryWEB
www.oracle.com/security-alerts/cpujul2020.htmlnvdThird Party AdvisoryWEB
github.com/dom4j/dom4j/commit/1707bf3d898a8ada3b213acb0e3b38f16eaae73dghsaWEB
lists.apache.org/thread.html/r51f3f9801058e47153c0ad9bc6209d57a592fc0e7aefd787760911b8@%3Cdev.velocity.apache.org%3EghsaWEB
lists.apache.org/thread.html/r91c64cd51e68e97d524395474eaa25362d564572276b9917fcbf5c32@%3Cdev.velocity.apache.org%3EghsaWEB
lists.apache.org/thread.html/rb1b990d7920ae0d50da5109b73b92bab736d46c9788dd4b135cb1a51@%3Cnotifications.freemarker.apache.org%3EghsaWEB
security.netapp.com/advisory/ntap-20200518-0002ghsaWEB
usn.ubuntu.com/4575-1ghsaWEB
www.oracle.com/security-alerts/cpujul2022.htmlnvdWEB
lists.apache.org/thread.html/r51f3f9801058e47153c0ad9bc6209d57a592fc0e7aefd787760911b8%40%3Cdev.velocity.apache.org%3Envd
lists.apache.org/thread.html/r91c64cd51e68e97d524395474eaa25362d564572276b9917fcbf5c32%40%3Cdev.velocity.apache.org%3Envd
lists.apache.org/thread.html/rb1b990d7920ae0d50da5109b73b92bab736d46c9788dd4b135cb1a51%40%3Cnotifications.freemarker.apache.org%3Envd

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.006
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000