● CVE — Critical
CVE-2020-10683
Vendororacle, dom4j projectProductjdeveloper, communications unified inventory management, agile product lifecycle management, financial services analytical applications infrastructure, banking platform, business process management suite, communications diameter signaling router, data integrator, fusion middleware, rapid planning, application testing suite, health sciences information manager, insurance rules palette, retail integration bus, enterprise manager base platform, flexcube core banking, primavera p6 enterprise project portfolio management, endeca information discovery integrator, agile plm, communications application session controller, dom4j, insurance policy administration j2ee, retail customer management and segmentation foundation, enterprise data quality, documaker, health sciences empirica signalDiscoveredMay 1, 2020UpdatedAug 25, 2026
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.