CVE-2018-1000632

dom4j: XML Injection in Class: Element. Methods: addElement, addAttribute which can impact the integrity of XML documents

Published Aug 20, 2018 CVSS 3.1 · 7.5 High EPSS 6.6% KEV · Not listed
Description
dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or elements in the XML document. This vulnerability appears to have been fixed in 2.1.1 or later.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-1517-1 dom4j security update
EUVD EUVD EUVD-2018-0521 dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or elements in the XML document. This vulnerability appears to have been fixed in 2.1.1 or later.
Github GHSA Github GHSA GHSA-6pcc-3rfx-4gpm Dom4j contains a XML Injection vulnerability
Ubuntu USN Ubuntu USN USN-4619-1 dom4j vulnerability
References
Link Providers
https://access.redhat.com/errata/RHSA-2019:0362 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:0364 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:0365 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:0380 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:1159 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:1160 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:1161 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:1162 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:3172 cve-icon cve-icon
https://github.com/dom4j/dom4j/commit/e598eb43d418744c4dbf62f647dd2381c9ce9387 cve-icon cve-icon
https://github.com/dom4j/dom4j/issues/48 cve-icon cve-icon
https://ihacktoprotect.com/post/dom4j-xml-injection/ cve-icon cve-icon
https://lists.apache.org/thread.html/00571f362a7a2470fba50a31282c65637c40d2e21ebe6ee535a4ed74%40%3Ccommits.maven.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/4a77652531d62299a30815cf5f233af183425db8e3c9a824a814e768%40%3Cdev.maven.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/5a020ecaa3c701f408f612f7ba2ee37a021644c4a39da2079ed3ddbc%40%3Ccommits.maven.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/7e9e78f0e4288fac6591992836d2a80d4df19161e54bd71ab4b8e458%40%3Cdev.maven.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/7f6e120e6ed473f4e00dde4c398fc6698eb383bd7857d20513e989ce%40%3Cdev.maven.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/9d4c1af6f702c3d6d6f229de57112ddccac8ce44446a01b7937ab9e0%40%3Ccommits.maven.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/d7d960b2778e35ec9b4d40c8efd468c7ce7163bcf6489b633491c89f%40%3Cdev.maven.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rb1b990d7920ae0d50da5109b73b92bab736d46c9788dd4b135cb1a51%40%3Cnotifications.freemarker.apache.org%3E cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2018/09/msg00028.html cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IOOVVCRQE6ATFD2JM2EMDXOQXTRIVZGP/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJULAHVR3I5SX7OSMXAG75IMNSAYOXGA/ cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2018-1000632 cve-icon
https://security.netapp.com/advisory/ntap-20190530-0001/ cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2018-1000632 cve-icon
https://www.oracle.com/security-alerts/cpuApr2021.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuapr2020.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujul2020.html cve-icon cve-icon
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html cve-icon cve-icon
History
Type Values Removed Values Added
Metrics epss

{'score': 0.01179}

epss

{'score': 0.00997}

Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:7::el7 cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7