CVE-2018-1000632
High
Description
dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or elements in the XML document. This vulnerability appears to have been fixed in 2.1.1 or later.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Dom4j
PublishedAug 20, 2018
First seenAug 20, 2018
How to fix
Update
- dom4j_project dom4j2.0.3, 2.1.1 or later
- org.dom4j:dom4j2.0.3, 2.1.1 or later
Vendor advisories
- access.redhat.com/errata/RHSA-2019:0364
- access.redhat.com/errata/RHSA-2019:0362
- access.redhat.com/errata/RHSA-2019:0365
- access.redhat.com/errata/RHSA-2019:0380
- access.redhat.com/errata/RHSA-2019:1160
- access.redhat.com/errata/RHSA-2019:1162
- access.redhat.com/errata/RHSA-2019:1159
- access.redhat.com/errata/RHSA-2019:1161
- access.redhat.com/errata/RHSA-2019:3172
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IOOVVCRQE6ATFD2JM2EMDXOQXTRIVZGP/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJULAHVR3I5SX7OSMXAG75IMNSAYOXGA/
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dom4j_project dom4j | 2.0.0 ≤ v < 2.0.3, 2.1.0 ≤ v < 2.1.1 | 2.0.3, 2.1.1 |
| debian debian_linux | 8.0 | — |
| oracle flexcube_investor_servicing | 12.0.4, 12.1.0, 12.3.0, 12.4.0, 14.0.0 | — |
| oracle primavera_p6_enterprise_project_portfolio_management | 16.1.0.0 ≤ v ≤ 16.2.20.1, 17.1.0.0 ≤ v ≤ 17.12.17.1, 18.1.0.0 ≤ v ≤ 18.8.19.0, 19.12.0.0 ≤ v ≤ 19.12.6.0 | — |
| oracle rapid_planning | 12.1, 12.2 | — |
| oracle retail_integration_bus | 15.0, 16.0 | — |
| oracle utilities_framework | 4.3.0.2.0 ≤ v ≤ 4.3.0.6.0, 2.2.0, 4.2.0.2.0, 4.2.0.3.0, 4.4.0.0.0, 4.4.0.2 | — |
| redhat satellite | 6.6 | — |
| redhat satellite_capsule | 6.6 | — |
| redhat jboss_enterprise_application_platform | 6.0.0, 6.4.0, 7.1.0 | — |
| netapp oncommand_workflow_automation | No range specified | — |
| netapp snap_creator_framework | No range specified | — |
| netapp snapcenter | No range specified | — |
| netapp snapmanager | No range specified | — |
| org.dom4j:dom4jMaven | v < 2.0.3, 2.1.0 ≤ v < 2.1.1 | 2.0.3, 2.1.1 |
| dom4j:dom4jMaven | v ≤ 1.6.1 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.