Exposed dangerous method or function in dom4j - CVE-2020-10683

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU28238

Exposed dangerous method or function in dom4j - CVE-2020-10683

Published: May 26, 2020


Vulnerability identifier: #VU28238
CSH Severity: Medium
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-10683
CWE-ID: CWE-749
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to abuse implemented functionality.

The vulnerability exists due to dom4j allows by default external DTDs and External Entities. A remote attacker can abuse this functionality and perform XXE attack against application that uses dom4j default configuration.


Affected software

dom4j
Netcool Operations Insight
Oracle Communications Application Session Controller
IBM Intelligent Operations Center
Oracle Communications Unified Inventory Management
Oracle Health Sciences Empirica Signal
IBM Integration Bus
Oracle Enterprise Data Quality
Enterprise Manager Base Platform
Primavera P6 Enterprise Project Portfolio Management
Atlas eDiscovery Process Management
Tivoli Composite Application Manager for Transactions
IBM Business Automation Workflow
IBM Cloud Pak for Business Automation
Oracle Utilities Framework
Oracle Utilities Network Management System
Oracle Banking Platform
RecoverPoint Classic
Oracle Agile Engineering Data Management
IBM Business Automation Manager Open Editions
Oracle Financial Services Analytical Applications Infrastructure
IBM Security Verify Information Queue
Oracle Insurance Rules Palette
Oracle Data Integrator
Oracle Application Testing Suite
Oracle Retail Order Broker
Oracle Retail Xstore Point of Service
CloudLink
Oracle Health Sciences Information Manager
Oracle Endeca Information Discovery Integrator
Oracle Insurance Policy Administration
Oracle Business Process Management Suite
Oracle Retail Price Management
IBM Qradar SIEM
Integrated Diameter Intelligence Hub (IDIH)
Oracle Agile PLM Framework
IBM App Connect Enterprise
Oracle JDeveloper
Oracle WebCenter Portal
Oracle Fusion Middleware
Oracle Commerce Platform
Oracle Commerce Guided Search
Oracle Retail Customer Management and Segmentation Foundation
Opensuse
Ubuntu
libdom4j-java (Ubuntu package)
IBM Disconnected Log Collector

How to mitigate CVE-2020-10683

Install updates from vendor's website.

dom4j - update to 2.1.3
Netcool Operations Insight - update to 1.6.5
IBM Intelligent Operations Center - update to 5.2.4
RecoverPoint Classic - update to 5.1 SP4 P4
IBM Qradar SIEM - update to 7.5.0 Update Pack 8
IBM Business Automation Manager Open Editions - update to 8.0.8
IBM Security Verify Information Queue - update to 10.0.3
Oracle Insurance Rules Palette - update to 11.3.1
libdom4j-java (Ubuntu package) - update to 1.6.1+dfsg.3-2ubuntu1.1
IBM Disconnected Log Collector - update to 1.8.3
Atlas eDiscovery Process Management - update to 6.0.3.9.7
Tivoli Composite Application Manager for Transactions - update to 7.4.0.2.22
CloudLink - update to 8.0-3.10.5.1
IBM Business Automation Workflow - addressed in versions 21.0.3 IF028, 23.0.2
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.28, 23.0.1.6

External References

Related Security Bulletins