VDB
CVE-2018-1000632
CVE-2018-1000632
PUBLISHED
CVSS 7.5 HIGH
dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or elements in the XML document. This vulnerability appears to have been fixed in 2.1.1 or later.
EPSS 6.57% · 93.7th percentile
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS Score
6.57%
93.7th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:16.04:LTS | dom4j | 1.6.1+dfsg.3-2ubuntu1.1, 1.6.1+dfsg.3-2ubuntu1, 0 |
| Ubuntu:18.04:LTS | dom4j | 2.1.0-2, 0, 1.6.1+dfsg.3-2ubuntu1 |
| Ubuntu:14.04:LTS | dom4j | *, 0 |
Timeline
- Aug 20, 2018 CVE Published
- Apr 14, 2021 EPSS Score
- Aug 25, 2021 EPSS Score
- Oct 26, 2021 EPSS Score
- Feb 4, 2022 EPSS Score
- Mar 1, 2022 EPSS Score
- Jul 4, 2022 EPSS Score
- Nov 8, 2022 EPSS Score
- Jan 10, 2023 EPSS Score
- Mar 13, 2023 EPSS Score
- May 15, 2023 EPSS Score
- Sep 18, 2023 EPSS Score
References
- https://ubuntu.com/security/CVE-2018-1000632 third-party-advisory
- https://github.com/dom4j/dom4j/commit/e598eb43d418744c4dbf62f647dd2381c9ce9387 third-party-advisory
- https://github.com/dom4j/dom4j/issues/48 third-party-advisory
- https://ihacktoprotect.com/post/dom4j-xml-injection/ third-party-advisory
- https://ubuntu.com/security/notices/USN-4619-1 vendor-advisory
- https://www.cve.org/CVERecord?id=CVE-2018-1000632 third-party-advisory