CVE-2020-10683

dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.

• CWE-611

• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00061.htmlThird Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1694235Issue Tracking, Patch, Third Party Advisory
• https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.htmlThird Party Advisory
• https://github.com/dom4j/dom4j/commit/a8228522a99a02146106672a34c104adbda5c658Patch, Third Party Advisory
• https://github.com/dom4j/dom4j/commits/version-2.0.3Patch, Third Party Advisory
• https://github.com/dom4j/dom4j/issues/87Third Party Advisory
• https://github.com/dom4j/dom4j/releases/tag/version-2.1.3Release Notes, Third Party Advisory
• https://lists.apache.org/thread.html/r51f3f9801058e47153c0ad9bc6209d57a592fc0e7aefd787760911b8%40%3Cdev.velocity.apache.org%3E
• https://lists.apache.org/thread.html/r91c64cd51e68e97d524395474eaa25362d564572276b9917fcbf5c32%40%3Cdev.velocity.apache.org%3E
• https://lists.apache.org/thread.html/rb1b990d7920ae0d50da5109b73b92bab736d46c9788dd4b135cb1a51%40%3Cnotifications.freemarker.apache.org%3E
• https://security.netapp.com/advisory/ntap-20200518-0002/Third Party Advisory
• https://usn.ubuntu.com/4575-1/Third Party Advisory
• https://www.oracle.com//security-alerts/cpujul2021.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpuApr2021.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpujan2021.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpujan2022.htmlThird Party Advisory
• https://www.oracle.com/security-alerts/cpujul2020.htmlThird Party Advisory
• https://www.oracle.com/security-alerts/cpujul2022.html
• https://www.oracle.com/security-alerts/cpuoct2020.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00061.htmlThird Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1694235Issue Tracking, Patch, Third Party Advisory
• https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.htmlThird Party Advisory
• https://github.com/dom4j/dom4j/commit/a8228522a99a02146106672a34c104adbda5c658Patch, Third Party Advisory
• https://github.com/dom4j/dom4j/commits/version-2.0.3Patch, Third Party Advisory
• https://github.com/dom4j/dom4j/issues/87Third Party Advisory
• https://github.com/dom4j/dom4j/releases/tag/version-2.1.3Release Notes, Third Party Advisory
• https://lists.apache.org/thread.html/r51f3f9801058e47153c0ad9bc6209d57a592fc0e7aefd787760911b8%40%3Cdev.velocity.apache.org%3E
• https://lists.apache.org/thread.html/r91c64cd51e68e97d524395474eaa25362d564572276b9917fcbf5c32%40%3Cdev.velocity.apache.org%3E
• https://lists.apache.org/thread.html/rb1b990d7920ae0d50da5109b73b92bab736d46c9788dd4b135cb1a51%40%3Cnotifications.freemarker.apache.org%3E
• https://security.netapp.com/advisory/ntap-20200518-0002/Third Party Advisory
• https://usn.ubuntu.com/4575-1/Third Party Advisory
• https://www.oracle.com//security-alerts/cpujul2021.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpuApr2021.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpujan2021.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpujan2022.htmlThird Party Advisory
• https://www.oracle.com/security-alerts/cpujul2020.htmlThird Party Advisory
• https://www.oracle.com/security-alerts/cpujul2022.html
• https://www.oracle.com/security-alerts/cpuoct2020.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory

Published

May 1, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-10675The Library API in buger jsonparser through 2019-12-04 allow…7.5
• CVE-2020-10676In Rancher 2.x before 2.6.13 and 2.7.x before 2.7.4, an inco…8.8
• CVE-2020-10678In Octopus Deploy before 2020.1.5, for customers running on-…8.8
• CVE-2020-1068An elevation of privilege vulnerability exists in Windows Me…7.8
• CVE-2020-10681The Filemanager in CMS Made Simple 2.2.13 has stored XSS via…5.4
• CVE-2020-10682The Filemanager in CMS Made Simple 2.2.13 allows remote code…7.8
• CVE-2020-10684A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.…7.1
• CVE-2020-10685A flaw was found in Ansible Engine affecting Ansible Engine …5.5
• CVE-2020-10686A flaw was found in Keycloak version 8.0.2 and 9.0.0, and wa…4.7
• CVE-2020-10687A flaw was discovered in all versions of Undertow before Und…4.8
• CVE-2020-10688A cross-site scripting (XSS) flaw was found in RESTEasy in v…6.1
• CVE-2020-10689A flaw was found in the Eclipse Che up to version 7.8.x, whe…6.8