EXPOSURES › CVE-2020-10683

CVE-2020-10683

CRITICAL

DETAIL

SourceNVD · cve Published2020-05-01 CVSS9.8 Referencehttps://nvd.nist.gov/vuln/detail/CVE-2020-10683 ↗

▸ RECOMMENDED ACTION Critical severity — schedule patching of the affected products.

PLAYERS IMPLICATED

NetApp · vendor Oracle · vendor canonical · vendor dom4j project · vendor opensuse · vendor Fusion Middleware · product agile product lifecycle management · product application testing suite · product banking platform · product business process management suite · product communications application session controller · product communications diameter signaling router · product communications unified inventory management · product data integrator · product documaker · product dom4j · product endeca information discovery integrator · product enterprise data quality · product enterprise manager base platform · product financial services analytical applications infrastructure · product flexcube core banking · product health sciences empirica signal · product health sciences information manager · product insurance policy administration j2ee · product insurance rules palette · product jdeveloper · product leap · product oncommand api services · product oncommand workflow automation · product primavera p6 enterprise project portfolio management · product rapid planning · product retail customer management and segmentation foundation · product retail integration bus · product retail order broker · product retail price management · product retail xstore point of service · product snap creator framework · product snapcenter · product snapmanager · product storagetek tape analytics sw tool · product ubuntu linux · product utilities framework · product webcenter portal · product

DESCRIPTION

dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.

SENTIMENT · TRUSTED SOURCES

synthesis mixed -0.20

Vulnerability acknowledged with available mitigation guidance.

cooey ↗ mixed -0.20

Vulnerability acknowledged with available mitigation guidance.

"dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j."

AFFECTED FEDRAMP PRODUCTS · 11

PRODUCT	PROVIDER	STATUS	MATCH
Aconex for Defense Oracle	Oracle	Authorized	vendor-exact · 0.90
Cloud Insights NetApp	NetApp	In Process	vendor-exact · 0.90
Federal Managed Cloud Services Oracle	Oracle	Authorized	vendor-exact · 0.90
Fusion Cloud Oracle	Oracle	Authorized	vendor-exact · 0.90
Government Cloud - Common Controls Oracle	Oracle	Authorized	vendor-exact · 0.90
Oracle Cloud Infrastructure-Government Cloud Oracle	Oracle	Authorized	vendor-exact · 0.90
Oracle Enterprise Performance Management (EPM) Oracle	Oracle	Authorized	vendor-exact · 0.90
Oracle Enterprise Performance Management (EPM) - Moderate Oracle	Oracle	In Process	vendor-exact · 0.90
Oracle Service Cloud Oracle	Oracle	Authorized	vendor-exact · 0.90
Oracle Service Cloud (DOD) Oracle	Oracle	Authorized	vendor-exact · 0.90
Taleo Cloud - U.S. Government Cloud Oracle	Oracle	Authorized	vendor-exact · 0.90