{"action":"Upgrade org.dom4j:dom4j to 2.0.3 (2.0.x) or 2.1.3 (2.1.x) or later.","affected":[{"fixed":"2.0.3","introduced":"0"},{"fixed":"2.1.3","introduced":"2.1.0"}],"component":"org.dom4j:dom4j","cve_ids":["CVE-2020-10683"],"ecosystem":"Maven","epss":0.07269,"exploited":false,"fixed_versions":["2.0.3","2.1.3"],"ghsa_id":"GHSA-hwj3-m3p6-hj38","id":"tcs_01M5N91H5V51VYR2SZA8BWSQM8","modified_at":"2024-03-08T05:17:29.315551Z","published_at":"2020-06-05T16:13:36Z","references":["https://osv.dev/vulnerability/GHSA-hwj3-m3p6-hj38","https://nvd.nist.gov/vuln/detail/CVE-2020-10683","https://github.com/dom4j/dom4j/issues/87","https://github.com/dom4j/dom4j/commit/1707bf3d898a8ada3b213acb0e3b38f16eaae73d","https://github.com/dom4j/dom4j/commit/a8228522a99a02146106672a34c104adbda5c658","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://usn.ubuntu.com/4575-1","https://security.netapp.com/advisory/ntap-20200518-0002","https://lists.apache.org/thread.html/rb1b990d7920ae0d50da5109b73b92bab736d46c9788dd4b135cb1a51@%3Cnotifications.freemarker.apache.org%3E","https://lists.apache.org/thread.html/r91c64cd51e68e97d524395474eaa25362d564572276b9917fcbf5c32@%3Cdev.velocity.apache.org%3E","https://lists.apache.org/thread.html/r51f3f9801058e47153c0ad9bc6209d57a592fc0e7aefd787760911b8@%3Cdev.velocity.apache.org%3E","https://github.com/dom4j/dom4j/releases/tag/version-2.1.3","https://github.com/dom4j/dom4j/commits/version-2.0.3","https://github.com/dom4j/dom4j","https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html","https://bugzilla.redhat.com/show_bug.cgi?id=1694235","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00061.html"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-hwj3-m3p6-hj38","url":"https://osv.dev/vulnerability/GHSA-hwj3-m3p6-hj38"}],"summary":"dom4j allows External Entities by default which might enable XXE attacks"}