CVE-2018-1000632
HIGH severity · CVSS 7.5 · CWE-91
7.5CVSS HIGH
Summary
dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or elements in the XML document. This vulnerability appears to have been fixed in 2.1.1 or later.
Impact & exploitability
Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
Confidentiality impactNone
Integrity impactHigh
Availability impactNone
Exploit probability (EPSS)6%
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected products we track (1)
Recommendation
Apply the vendor fix promptly. Open any affected product above for its exact safe version.
Additional information
- NVD record
- https://access.redhat.com/errata/RHSA-2019:0362Advisory
- https://access.redhat.com/errata/RHSA-2019:0364Advisory
- https://access.redhat.com/errata/RHSA-2019:0365Advisory
- https://access.redhat.com/errata/RHSA-2019:0380Advisory
- https://access.redhat.com/errata/RHSA-2019:1159Advisory
- https://access.redhat.com/errata/RHSA-2019:1160Advisory
- https://access.redhat.com/errata/RHSA-2019:1161Advisory
- https://access.redhat.com/errata/RHSA-2019:1162Advisory