Vulnerability Database

289,599

Total vulnerabilities in the database

CVE-2018-1000632

dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or elements in the XML document. This vulnerability appears to have been fixed in 2.1.1 or later.

CVSS v3:

  • Severity: High
  • Score: 7.5
  • AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CVSS v2:

  • Severity: Medium
  • Score: 5
  • AV:N/AC:L/Au:N/C:N/I:P/A:N

CWEs:

OWASP TOP 10:

Software From Fixed in
dom4j_project / dom4j 2.0.0 2.0.3
dom4j_project / dom4j 2.1.0 2.1.1
debian / debian_linux 8.0 8.0.x
oracle / flexcube_investor_servicing 12.3.0 12.3.0.x
oracle / flexcube_investor_servicing 12.1.0 12.1.0.x
oracle / flexcube_investor_servicing 12.0.4 12.0.4.x
oracle / retail_integration_bus 15.0 15.0.x
oracle / utilities_framework 4.2.0.3.0 4.2.0.3.0.x
oracle / utilities_framework 4.2.0.2.0 4.2.0.2.0.x
oracle / flexcube_investor_servicing 12.4.0 12.4.0.x
oracle / flexcube_investor_servicing 14.0.0 14.0.0.x
oracle / retail_integration_bus 16.0 16.0.x
oracle / utilities_framework 4.4.0.0.0 4.4.0.0.0.x
oracle / primavera_p6_enterprise_project_portfolio_management 17.1.0.0 17.12.17.1.x
oracle / primavera_p6_enterprise_project_portfolio_management 16.1.0.0 16.2.20.1.x
oracle / primavera_p6_enterprise_project_portfolio_management 18.1.0.0 18.8.19.0.x
oracle / rapid_planning 12.1 12.1.x
oracle / rapid_planning 12.2 12.2.x
oracle / utilities_framework 4.4.0.2 4.4.0.2.x
oracle / utilities_framework 2.2.0 2.2.0.x
oracle / utilities_framework 4.3.0.2.0 4.3.0.6.0.x
oracle / primavera_p6_enterprise_project_portfolio_management 19.12.0.0 19.12.6.0.x
redhat / satellite_capsule 6.6 6.6.x
redhat / satellite 6.6 6.6.x
redhat / jboss_enterprise_application_platform 6.0.0 6.0.0.x
redhat / jboss_enterprise_application_platform 6.4.0 6.4.0.x
redhat / jboss_enterprise_application_platform 7.1.0 7.1.0.x
org.dom4j / dom4j - 2.0.3
org.dom4j / dom4j 2.1.0 2.1.0.x
org.dom4j / dom4j 2.1.0 2.1.1
dom4j / dom4j - 1.6.1.x