National Vulnerability Database

National Vulnerability Database

National Vulnerability
Database

CVE-2018-1000632 Detail

Current Description

dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or elements in the XML document. This vulnerability appears to have been fixed in 2.1.1 or later.

Source:  MITRE
View Analysis Description

Severity



CVSS 3.x Severity and Metrics:

NIST CVSS score
NIST: NVD
Base Score: 7.5 HIGH
Vector:  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Hyperlink Resource
https://access.redhat.com/errata/RHSA-2019:0362 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0364 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0365 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0380 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1159
https://access.redhat.com/errata/RHSA-2019:1160
https://access.redhat.com/errata/RHSA-2019:1161
https://access.redhat.com/errata/RHSA-2019:1162
https://access.redhat.com/errata/RHSA-2019:3172
https://github.com/dom4j/dom4j/commit/e598eb43d418744c4dbf62f647dd2381c9ce9387 Patch Third Party Advisory
https://github.com/dom4j/dom4j/issues/48 Patch Third Party Advisory
https://ihacktoprotect.com/post/dom4j-xml-injection/ Exploit Third Party Advisory
https://lists.apache.org/thread.html/00571f362a7a2470fba50a31282c65637c40d2e21ebe6ee535a4ed74@%3Ccommits.maven.apache.org%3E
https://lists.apache.org/thread.html/4a77652531d62299a30815cf5f233af183425db8e3c9a824a814e768@%3Cdev.maven.apache.org%3E
https://lists.apache.org/thread.html/5a020ecaa3c701f408f612f7ba2ee37a021644c4a39da2079ed3ddbc@%3Ccommits.maven.apache.org%3E
https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451@%3Csolr-user.lucene.apache.org%3E
https://lists.apache.org/thread.html/7e9e78f0e4288fac6591992836d2a80d4df19161e54bd71ab4b8e458@%3Cdev.maven.apache.org%3E
https://lists.apache.org/thread.html/7f6e120e6ed473f4e00dde4c398fc6698eb383bd7857d20513e989ce@%3Cdev.maven.apache.org%3E
https://lists.apache.org/thread.html/9d4c1af6f702c3d6d6f229de57112ddccac8ce44446a01b7937ab9e0@%3Ccommits.maven.apache.org%3E
https://lists.apache.org/thread.html/d7d960b2778e35ec9b4d40c8efd468c7ce7163bcf6489b633491c89f@%3Cdev.maven.apache.org%3E
https://lists.debian.org/debian-lts-announce/2018/09/msg00028.html Mailing List Third Party Advisory
https://security.netapp.com/advisory/ntap-20190530-0001/
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html Patch Third Party Advisory

Weakness Enumeration

CWE-ID CWE Name Source
CWE-91 XML Injection (aka Blind XPath Injection) NIST  

Known Affected Software Configurations Switch to CPE 2.3

Configuration 1 ( hide )
 cpe:/a:dom4j_project:dom4j
     Show Matching CPE(s)
Up to (excluding)
2.1.1

Configuration 2 ( hide )
 cpe:/o:debian:debian_linux:8.0
     Show Matching CPE(s)

Configuration 3 ( hide )
 cpe:/a:oracle:flexcube_investor_servicing:12.0.4
     Show Matching CPE(s)
 cpe:/a:oracle:flexcube_investor_servicing:12.1.0
     Show Matching CPE(s)
 cpe:/a:oracle:flexcube_investor_servicing:12.3.0
     Show Matching CPE(s)
 cpe:/a:oracle:flexcube_investor_servicing:12.4.0
     Show Matching CPE(s)
 cpe:/a:oracle:flexcube_investor_servicing:14.0.0
     Show Matching CPE(s)


Change History

17 change records found - show changes

Quick Info

CVE Dictionary Entry:
CVE-2018-1000632
NVD Published Date:
08/20/2018
NVD Last Modified:
06/10/2019