dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in…
Priority MEDIUM 42CWE-91Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 12 fixed, 14 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or elements in the XML document. This vulnerability appears to have been fixed in 2.1.1 or later.
Why it matters now
EPSS 0.0657 93rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial org.dom4j:dom4j (Maven): 2.0.3, 2.1.1Red Hat: 9 advisoriesRed Hat: 12 fixed, 14 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.dom4j:dom4j (Maven) | before 2.0.3 | 2.0.3 | Patch available | GHSA-6pcc-3rfx-4gpm |
| — | org.dom4j:dom4j (Maven) | 2.1.0 to before 2.1.1 | 2.1.1 | Patch available | GHSA-6pcc-3rfx-4gpm |
| — | dom4j:dom4j (Maven) | up to 1.6.1 | — | No fix listed | GHSA-6pcc-3rfx-4gpm |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.dom4j:dom4j (Maven) Vendor— Affected before 2.0.3 Fixed in 2.0.3 Patch available GHSA-6pcc-3rfx-4gpm
- org.dom4j:dom4j (Maven) Vendor— Affected 2.1.0 to before 2.1.1 Fixed in 2.1.1 Patch available GHSA-6pcc-3rfx-4gpm
- dom4j:dom4j (Maven) Vendor— Affected up to 1.6.1 Fixed in — No fix listed GHSA-6pcc-3rfx-4gpm
CPE configurations NVD · 31
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:dom4j_project:dom4j:*:*:*:*:*:*:*:* | 2.0.0 to before 2.0.3; 2.1.0 to before 2.1.1 | Vulnerable | Dom4j Project |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Debian |
| cpe:2.3:a:oracle:flexcube_investor_servicing:12.0.4:*:*:*:*:*:*:* | 12.0.4 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:flexcube_investor_servicing:12.1.0:*:*:*:*:*:*:* | 12.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:flexcube_investor_servicing:12.3.0:*:*:*:*:*:*:* | 12.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:flexcube_investor_servicing:12.4.0:*:*:*:*:*:*:* | 12.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:flexcube_investor_servicing:14.0.0:*:*:*:*:*:*:* | 14.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:*:*:*:*:*:*:*:* | 16.1.0.0 – 16.2.20.1; 17.1.0.0 – 17.12.17.1; 18.1.0.0 – 18.8.19.0; 19.12.0.0 – 19.12.6.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:rapid_planning:12.1:*:*:*:*:*:*:* | 12.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:rapid_planning:12.2:*:*:*:*:*:*:* | 12.2 | Vulnerable | Oracle |
- cpe:2.3:a:dom4j_project:dom4j:*:*:*:*:*:*:*:* Versions 2.0.0 to before 2.0.3; 2.1.0 to before 2.1.1 Vulnerable ·Dom4j Project
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
- cpe:2.3:a:oracle:flexcube_investor_servicing:12.0.4:*:*:*:*:*:*:* Versions 12.0.4 Vulnerable ·Oracle
- cpe:2.3:a:oracle:flexcube_investor_servicing:12.1.0:*:*:*:*:*:*:* Versions 12.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:flexcube_investor_servicing:12.3.0:*:*:*:*:*:*:* Versions 12.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:flexcube_investor_servicing:12.4.0:*:*:*:*:*:*:* Versions 12.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:flexcube_investor_servicing:14.0.0:*:*:*:*:*:*:* Versions 14.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:*:*:*:*:*:*:*:* Versions 16.1.0.0 – 16.2.20.1; 17.1.0.0 – 17.12.17.1; 18.1.0.0 – 18.8.19.0; 19.12.0.0 – 19.12.6.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:rapid_planning:12.1:*:*:*:*:*:*:* Versions 12.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:rapid_planning:12.2:*:*:*:*:*:*:* Versions 12.2 Vulnerable ·Oracle
Show 21 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:retail_integration_bus:15.0:*:*:*:*:*:*:* | 15.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_integration_bus:16.0:*:*:*:*:*:*:* | 16.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:utilities_framework:*:*:*:*:*:*:*:* | 4.3.0.2.0 – 4.3.0.6.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:utilities_framework:2.2.0:*:*:*:*:*:*:* | 2.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:utilities_framework:4.2.0.2.0:*:*:*:*:*:*:* | 4.2.0.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:utilities_framework:4.2.0.3.0:*:*:*:*:*:*:* | 4.2.0.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:utilities_framework:4.4.0.0.0:*:*:*:*:*:*:* | 4.4.0.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:utilities_framework:4.4.0.2:*:*:*:*:*:*:* | 4.4.0.2 | Vulnerable | Oracle |
| cpe:2.3:a:redhat:satellite:6.6:*:*:*:*:*:*:* | 6.6 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:satellite_capsule:6.6:*:*:*:*:*:*:* | 6.6 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:* | 6.0.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4.0:*:*:*:*:*:*:* | 6.4.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1.0:*:*:*:*:*:*:* | 7.1.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* | 6.0 | Running on | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* | 7.0 | Running on | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:* | 5.0 | Running on | Red Hat |
| cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:oracle:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:oracle:retail_integration_bus:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_integration_bus:16.0:*:*:*:*:*:*:* Versions 16.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:utilities_framework:*:*:*:*:*:*:*:* Versions 4.3.0.2.0 – 4.3.0.6.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:utilities_framework:2.2.0:*:*:*:*:*:*:* Versions 2.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:utilities_framework:4.2.0.2.0:*:*:*:*:*:*:* Versions 4.2.0.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:utilities_framework:4.2.0.3.0:*:*:*:*:*:*:* Versions 4.2.0.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:utilities_framework:4.4.0.0.0:*:*:*:*:*:*:* Versions 4.4.0.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:utilities_framework:4.4.0.2:*:*:*:*:*:*:* Versions 4.4.0.2 Vulnerable ·Oracle
- cpe:2.3:a:redhat:satellite:6.6:*:*:*:*:*:*:* Versions 6.6 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:satellite_capsule:6.6:*:*:*:*:*:*:* Versions 6.6 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4.0:*:*:*:*:*:*:* Versions 6.4.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1.0:*:*:*:*:*:*:* Versions 7.1.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Running on ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:* Versions 5.0 Running on ·Red Hat
- cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:oracle:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:* Versions not specified by NVD Vulnerable ·NetApp
Remediation
- Fix · GHSA-6pcc-3rfx-4gpm org.dom4j:dom4j (Maven) Fixed in 2.0.3 Advisory →
- Fix · GHSA-6pcc-3rfx-4gpm org.dom4j:dom4j (Maven) Fixed in 2.1.1 Advisory →
Red Hat 9 advisories
- RHSA-2020:3192 Released 2020-07-28 · Red Hat rating ImportantRed Hat Fuse 7.7.0 release and security update
- Red Hat Fuse 7.7.0
- RHSA-2019:3172 Released 2019-10-22 · Red Hat rating ModerateRed Hat Satellite 6 security, bug fix, and enhancement update
- Red Hat Satellite 6.6 ansible-runner-1.3.4-2.el7ar, ansiblerole-foreman_scap_client-0.0.3-1.el7sat, ansiblerole-insights-client-1.6-2.el7sat +47
- Red Hat Satellite Capsule 6.6 ansible-runner-1.3.4-2.el7ar, ansiblerole-foreman_scap_client-0.0.3-1.el7sat, ansiblerole-insights-client-1.6-2.el7sat +47
- RHSA-2019:1162 Released 2019-05-13 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 6.4.22 security update
- Red Hat JBoss Enterprise Application Platform 6.4
Show 6 more Red Hat advisories
- RHSA-2019:1160 Released 2019-05-13 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 6.4.22 security update
- Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server apache-cxf-2.7.18-8.SP7_redhat_1.1.ep6.el6, dom4j-eap6-1.6.1-22.redhat_9.1.ep6.el6, hornetq-2.3.25-28.SP29_redhat_1.1.ep6.el6 +47
- RHSA-2019:1161 Released 2019-05-13 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 6.4.22 security update
- Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server apache-cxf-2.7.18-8.SP7_redhat_1.1.ep6.el7, dom4j-eap6-1.6.1-22.redhat_9.1.ep6.el7, hornetq-2.3.25-28.SP29_redhat_1.1.ep6.el7 +47
- RHSA-2019:1159 Released 2019-05-13 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 6.4.22 security update
- Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 Server apache-cxf-2.7.18-8.SP7_redhat_1.1.ep6.el5, dom4j-eap6-1.6.1-22.redhat_9.1.ep6.el5, hornetq-2.3.25-28.SP29_redhat_1.1.ep6.el5 +47
- RHSA-2019:0380 Released 2019-02-19 · Red Hat rating ModerateRed Hat Single Sign-On 7.2.6 security update
- Red Hat Single Sign-On 7.2.6 zip
- RHSA-2019:0364 Released 2019-02-18 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 7.1.6 on RHEL 6 security update
- Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server eap7-activemq-artemis-1.5.5.015-1.redhat_00001.1.ep7.el6, eap7-activemq-artemis-cli-1.5.5.015-1.redhat_00001.1.ep7.el6, eap7-activemq-artemis-commons-1.5.5.015-1.redhat_00001.1.ep7.el6 +47
- RHSA-2019:0365 Released 2019-02-18 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 7.1.6 for RHEL 7 security update
- Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server eap7-activemq-artemis-1.5.5.015-1.redhat_00001.1.ep7.el7, eap7-activemq-artemis-cli-1.5.5.015-1.redhat_00001.1.ep7.el7, eap7-activemq-artemis-commons-1.5.5.015-1.redhat_00001.1.ep7.el7 +47
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat BPM Suite 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Will not fix |
| Red Hat JBoss BRMS 5 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss BRMS 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 5 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Enterprise Web Server 2 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Enterprise Web Server 3 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Operations Network 3 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss SOA Platform 5 | Affected | No fix planned: Out of support scope |
| Red Hat Satellite 5 | Affected | No fix planned: Will not fix |
| Red Hat Software Collections | Affected | No fix planned: Will not fix |
| Red Hat Subscription Asset Manager | Affected | No fix planned: Will not fix |
| Red Hat Fuse 7.7.0 | Fixed | RHSA-2020:3192 |
| Red Hat JBoss Enterprise Application Platform 6.4 | Fixed | RHSA-2019:1162 |
| Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 Server | Fixed | RHSA-2019:1159 |
| Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server | Fixed | RHSA-2019:1160 |
| Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server | Fixed | RHSA-2019:1161 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server | Fixed | RHSA-2019:0364 |
| Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server | Fixed | RHSA-2019:0365 |
| Red Hat Satellite 6.6 | Fixed | RHSA-2019:3172 |
| Red Hat Satellite Capsule 6.6 | Fixed | RHSA-2019:3172 |
| Red Hat Single Sign-On 7.2.6 zip | Fixed | RHSA-2019:0380 |
| Red Hat Virtualization 4 Hypervisor for RHEL 7 | Fixed | — |
| Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts | Fixed | — |
Not affected: 5 products
- Red Hat Decision Manager 7
- Red Hat Mobile Application Platform 4
- Red Hat Process Automation 7
- Red Hat Single Sign-On 7
- Red Hat support for Spring Boot
Timeline
- 2026-10-02 Threatist record created from CVE-2018-1000632
- 2026-10-03 Alias added: GHSA-6pcc-3rfx-4gpm
References
Patch 2
Advisory 18
- [debian-lts-announce] 20180924 [SECURITY] [DLA 1517-1] dom4j security update
- RHSA-2019:0364
- RHSA-2019:0362
- RHSA-2019:0365
- RHSA-2019:0380
- RHSA-2019:1160
- RHSA-2019:1162
- RHSA-2019:1159
- RHSA-2019:1161
- RHSA-2019:3172
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://github.com/dom4j/dom4j/issues/48
- https://security.netapp.com/advisory/ntap-20190530-0001/
- FEDORA-2021-f28c870528
- FEDORA-2021-8015a8cdc4
- https://nvd.nist.gov/vuln/detail/CVE-2018-1000632
- https://github.com/advisories/GHSA-6pcc-3rfx-4gpm
Other 25
- [lucene-solr-user] 20190104 Re: SOLR v7 Security Issues Caused Denial of Use - Sonatype Application Composition Report
- [maven-dev] 20190531 proposal for maven-archetype to switch to dom4j 2.1.1 (and Java 8)
- [maven-dev] 20190531 Re: proposal for maven-archetype to switch to dom4j 2.1.1 (and Java 8)
- [maven-commits] 20190531 [maven-archetype] 01/01: ARCHETYPE-567: switch to dom4j 2.1.1 (and Java 8) dom4j 2.1.1 requires Java 8 dom4j 2.0.2 would retain Java 7 but is vulnerable to CVE-2018-1000632 dom4j 2.0.3 fixes CVE-2018-1000632 but has been pending for ~1 year
- [maven-commits] 20190601 [maven-archetype] 01/01: ARCHETYPE-567: switch to dom4j 2.1.1 (and Java 8) dom4j 2.1.1 requires Java 8 dom4j 2.0.2 would retain Java 7 but is vulnerable to CVE-2018-1000632 dom4j 2.0.3 fixes CVE-2018-1000632 but has been pending for ~1 year
- [maven-dev] 20190603 Re: proposal for maven-archetype to switch to dom4j 2.1.1 (and Java 8)
- [maven-commits] 20190604 [maven-archetype] branch master updated: ARCHETYPE-567: switch to dom4j 2.1.1 (and Java 8) dom4j 2.1.1 requires Java 8 dom4j 2.0.2 would retain Java 7 but is vulnerable to CVE-2018-1000632 dom4j 2.0.3 fixes CVE-2018-1000632 but has been pending for ~1 year
- [maven-dev] 20190610 Re: proposal for maven-archetype to switch to dom4j 2.1.1 (and Java 8)
- https://www.oracle.com/security-alerts/cpuApr2021.html
- [freemarker-notifications] 20210906 [jira] [Created] (FREEMARKER-190) The jar dom4j has known security issue that Freemarker compiles dependend on it
- https://github.com/dom4j/dom4j/commit/c2a99d7dee8ce7a4e5bef134bb781a6672bd8a0f
- https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451@%3Csolr-user.lucene.apache.org%3E
- https://lists.apache.org/thread.html/7e9e78f0e4288fac6591992836d2a80d4df19161e54bd71ab4b8e458@%3Cdev.maven.apache.org%3E
- https://lists.apache.org/thread.html/7f6e120e6ed473f4e00dde4c398fc6698eb383bd7857d20513e989ce@%3Cdev.maven.apache.org%3E
- https://lists.apache.org/thread.html/9d4c1af6f702c3d6d6f229de57112ddccac8ce44446a01b7937ab9e0@%3Ccommits.maven.apache.org%3E
- https://lists.apache.org/thread.html/d7d960b2778e35ec9b4d40c8efd468c7ce7163bcf6489b633491c89f@%3Cdev.maven.apache.org%3E
- https://lists.apache.org/thread.html/rb1b990d7920ae0d50da5109b73b92bab736d46c9788dd4b135cb1a51@%3Cnotifications.freemarker.apache.org%3E
- https://lists.fedoraproject.org/archives/list/[email protected]/message/IOOVVCRQE6ATFD2JM2EMDXOQXTRIVZGP
- https://lists.fedoraproject.org/archives/list/[email protected]/message/KJULAHVR3I5SX7OSMXAG75IMNSAYOXGA
- https://security.netapp.com/advisory/ntap-20190530-0001
- https://lists.apache.org/thread.html/5a020ecaa3c701f408f612f7ba2ee37a021644c4a39da2079ed3ddbc@%3Ccommits.maven.apache.org%3E
- https://lists.apache.org/thread.html/4a77652531d62299a30815cf5f233af183425db8e3c9a824a814e768@%3Cdev.maven.apache.org%3E
- https://lists.apache.org/thread.html/00571f362a7a2470fba50a31282c65637c40d2e21ebe6ee535a4ed74@%3Ccommits.maven.apache.org%3E
- https://ihacktoprotect.com/post/dom4j-xml-injection
- https://github.com/dom4j/dom4j
Sources
- CVE-2018-1000632 · CVE Program
- CVE-2018-1000632 · NVD
- FIRST EPSS
- GHSA-6pcc-3rfx-4gpm · GitHub Advisory Database · CC BY 4.0
- CVE-2018-1000632 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences