Ubuntu update for dom4j



| Updated: 2025-04-23
Risk Medium
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2020-10683
CWE-ID CWE-749
Exploitation vector Network
Public exploit N/A
Vulnerable software
 Ubuntu
Operating systems & Components / Operating system

libdom4j-java (Ubuntu package)
Operating systems & Components / Operating system package or component

Vendor Canonical Ltd.

Security Bulletin

This security bulletin contains one medium risk vulnerability.

1) Exposed dangerous method or function

EUVDB-ID: #VU28238

Risk: Medium

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-10683

CWE-ID: CWE-749 - Exposed Dangerous Method or Function

Exploit availability: No

Description

The vulnerability allows a remote attacker to abuse implemented functionality.

The vulnerability exists due to dom4j allows by default external DTDs and External Entities. A remote attacker can abuse this functionality and perform XXE attack against application that uses dom4j default configuration.

Mitigation

Update the affected package dom4j to the latest version.

Vulnerable software versions

Ubuntu: 16.04

libdom4j-java (Ubuntu package): before 1.6.1+dfsg.3-2ubuntu1.1

CPE2.3 External links

https://ubuntu.com/security/notices/USN-4575-1


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###