Описание
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.
Отчет
OpenShift Container Platform ships a vulnerable version of dom4j library. However it's used to parse configuration files, which are local disk resources. We've rated this issue with a moderate impact for OpenShift Container Platform.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat BPM Suite 6 | dom4j | Out of support scope | ||
| Red Hat Enterprise Linux 7 | dom4j | Affected | ||
| Red Hat JBoss BRMS 5 | dom4j | Out of support scope | ||
| Red Hat JBoss BRMS 6 | dom4j | Out of support scope | ||
| Red Hat JBoss Data Grid 7 | dom4j | Not affected | ||
| Red Hat JBoss Data Virtualization 6 | dom4j | Out of support scope | ||
| Red Hat JBoss Enterprise Application Platform 5 | dom4j | Out of support scope | ||
| Red Hat JBoss Enterprise Application Platform 6 | dom4j | Out of support scope | ||
| Red Hat JBoss Enterprise Web Server 2 | dom4j | Out of support scope | ||
| Red Hat JBoss Enterprise Web Server 3 | dom4j | Out of support scope |
Показывать по
Дополнительная информация
Статус:
EPSS
7.4 High
CVSS3
Связанные уязвимости
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and Ext ...
dom4j allows External Entities by default which might enable XXE attacks
EPSS
7.4 High
CVSS3