CVE-2020-10683

9.8 criticalEPSS 7.3%

Critical (9.8). EPSS 7.3% chance of exploitation in the next 30 days. Fixed in org.dom4j:dom4j 2.0.3, 2.1.3.

dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 7.3% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-31)
CWE: CWE-611
Published: 2020-05-01
Modified: 2026-08-25
Record from: the NVD, synced 2026-10-19

Affected

canonical:ubuntu_linux
dom4j_project:dom4j
netapp:oncommand_api_services
netapp:oncommand_workflow_automation
netapp:snap_creator_framework
netapp:snapcenter
netapp:snapmanager
opensuse:leap
oracle:agile_product_lifecycle_management
oracle:application_testing_suite
oracle:banking_platform
oracle:business_process_management_suite
oracle:communications_application_session_controller
oracle:communications_diameter_signaling_router
oracle:communications_unified_inventory_management
oracle:data_integrator
oracle:documaker
oracle:endeca_information_discovery_integrator
oracle:enterprise_data_quality
oracle:enterprise_manager_base_platform
oracle:financial_services_analytical_applications_infrastructure
oracle:flexcube_core_banking
oracle:fusion_middleware
oracle:health_sciences_empirica_signal
oracle:health_sciences_information_manager
oracle:insurance_policy_administration_j2ee
oracle:insurance_rules_palette
oracle:jdeveloper
oracle:primavera_p6_enterprise_project_portfolio_management
oracle:rapid_planning
oracle:retail_customer_management_and_segmentation_foundation
oracle:retail_integration_bus
oracle:retail_order_broker
oracle:retail_price_management
oracle:retail_xstore_point_of_service
oracle:storagetek_tape_analytics_sw_tool
oracle:utilities_framework
oracle:webcenter_portal

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-hwj3-m3p6-hj38	Maven	org.dom4j:dom4j	<2.0.3	2.0.3
GHSA-hwj3-m3p6-hj38	Maven	org.dom4j:dom4j	>=2.1.0 <2.1.3	2.1.3
GHSA-hwj3-m3p6-hj38	Maven	dom4j:dom4j	<=1.6.1	no fix published

References

Check your stack JSON