CVE-2020-10683
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk94th percentile - higher than 94% of all known CVEs
Summary
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.
Risk Assessment
XXE attacks can lead to disclosure of sensitive files, internal port scanning, or SSRF requests, posing a serious threat to system confidentiality and integrity.
Recommendation
It is recommended to upgrade dom4j to version 2.0.3 or 2.1.3 and configure secure XML processing according to OWASP guidelines to disable external entities and DTDs.
Original NVD description (English source)
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.