WaratekVRT Sign in

CVE-2020-10683 dom4j

Affected softwaredom4j
Severity9.8 Critical CVSS 3.1 2 scores
Fixed in2.0.3, 2.1.3
WeaknessXML external entity (XXE) (CWE-611)
Published1 May 2020
Updated13 Nov 2026

Description

dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 6 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC none indexed
  • EPSS 7.3% chance in 30 days

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

  • Protection full XXE
  • Action available security rule
  • Review human Researcher
  • Record active
Decided by A researcher's recorded decision for this specific CVE
Finding A researcher found this CVE protected by the ARMR XXE rule.

Waratek research note

written 2026-11-13

Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.

Comments

Rule Name: XXE rule

  • dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default which might enable XXE attacks. However there is popular external documentation from OWASP showing how to enable the safe non-default behavior in any application that uses dom4j. A flaw was found in dom4j library. By using the default SaxReader() provided by Dom4J external DTDs and External Entities are allowed resulting in a possible XXE.

How to mitigate CVE-2020-10683

Upgrade dom4j to a release that fixes it: 2.0.3 or 2.1.3. Until you can, Waratek RASP blocks exploitation with its XXE rule. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

CVSS

9.8 CRITICAL v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 2.0 7.5 none AV:N/AC:L/Au:N/C:P/I:P/A:P NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update January 2026 ↗ CPU 2026-Q1 Oracle Siebel CRM / Application Interface (JDOM) (17.0-25.11)
Oracle Critical Patch Update January 2023 ↗ CPU 2023-Q1 Oracle Utilities Applications / Content Acquisition System (dom4j) (2.3.0.2, 2.4.0.1, 2.5.0.0, 2.5.0.1, 2.5.0.2)
Oracle Critical Patch Update October 2022 ↗ CPU 2022-Q4 Oracle Commerce / Dynamo Application Framework (dom4j) (11.3.0-11.3.2)
Oracle Critical Patch Update July 2022 ↗ CPU 2022-Q3 Oracle Commerce / Content Acquisition System (dom4j) (11.3.2)
Oracle Supply Chain / Installation Issues (dom4j) (6.2.1.0)
Oracle Critical Patch Update January 2022 ↗ CPU 2022-Q1 Oracle Insurance Applications / Architecture (dom4j) (10.2.0, 10.2.4, 11.0.2, 11.1.0-11.3.0)
Oracle Insurance Applications / Architecture (dom4j) (10.2.0, 10.2.4, 11.0.2, 11.1.0-11.3.0)
Oracle Critical Patch Update October 2021 ↗ CPU 2021-Q4 Oracle Financial Services Applications / Bills And Collections (dom4j) (11.7, 11.8, 11.9, 11.10)
Oracle Insurance Applications / Development tools (dom4j) (12.6.0 - 12.6.4)
Oracle Critical Patch Update July 2021 ↗ CPU 2021-Q3 Oracle Enterprise Manager / Application Service Level Mgmt (dom4j) (13.4.0.0)
Oracle Fusion Middleware / Oracle JDeveloper (dom4j) (12.2.1.4.0)
Oracle Systems / Software (dom4j) (2.3)
Oracle Critical Patch Update April 2021 ↗ CPU 2021-Q2 Oracle Fusion Middleware / Centralized Thirdparty Jars (dom4j) (12.2.1.4.0)
Oracle Retail Applications / Xenvironment (dom4j) (15.0.4, 16.0.6, 17.0.4, 18.0.3)
Oracle Critical Patch Update January 2021 ↗ CPU 2021-Q1 Oracle Enterprise Manager / Load Testing for Web Apps (dom4j) (13.3.0.1)
Oracle Fusion Middleware / General (dom4j) (11.1.1.9.0, 12.2.1.3.0)
Oracle Fusion Middleware / Installer (dom4j) (12.2.1.3.0, 12.2.1.4.0)
Oracle Fusion Middleware / Portlet Services (dom4j) (11.1.1.9.0)
Oracle Fusion Middleware / Runtime Java agent for ODI (dom4j) (12.2.1.3.0, 12.2.1.4.0)
Oracle Health Sciences Applications / Recordlocator, DSUB (dom4j) (3.0.1)
Oracle Retail Applications / Segment (dom4j) (16.0, 17.0, 18.0, 19.0)
Oracle Critical Patch Update October 2020 ↗ CPU 2020-Q4 Oracle Communications / IDIH (dom4j) (IDIH: 8.0.0-8.2.2)
Oracle Communications / WS and WEB (dom4j) (3.9m0p1)
Oracle Communications Applications / Core (dom4j) (7.3.0, 7.4.0)
Oracle Financial Services Applications / Collections (dom4j) (2.4.0-2.10.0)
Oracle Financial Services Applications / Infrastructure (dom4j) (8.0.6-8.1.0)
Oracle Fusion Middleware / Integrator ETL (dom4j) (3.2.0)
Oracle Fusion Middleware / Portlet Services (dom4j) (12.2.1.3.0, 12.2.1.4.0)
Oracle Health Sciences Applications / User Interface (dom4j) (9.0)
Oracle Retail Applications / Security (dom4j) (14.0.4, 14.1.3.0, 15.0.3.0, 16.0.3.0)
Oracle Retail Applications / System Administration (dom4j) (15.0, 16.0, 18.0, 19.0, 19.1)
Oracle Supply Chain / Security (dom4j) (9.3.3, 9.3.5)
Oracle Utilities Applications / General (dom4j) (2.2.0.0.0, 4.2.0.2.0, 4.2.0.3.0, 4.3.0.1.0 - 4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0)
Oracle Critical Patch Update July 2020 ↗ CPU 2020-Q3 Oracle Construction and Engineering / Web Access (dom4j) (16.1.0.0-16.2.20.1, 17.1.0.0-17.12.17.1, 18.1.0.0-18.8.19, 19.12.0-19.12.6)
Oracle Retail Applications / RIB Kernal (dom4j) (15.0, 16.0)
Oracle Supply Chain / Middle Tier (dom4j) (12.1, 12.2)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Commerce Content Acquisition System (dom4j) 11.3.2 11.3.2
Oracle Commerce Dynamo Application Framework (dom4j) 11.3.0-11.3.2
Oracle Communications IDIH (dom4j) IDIH: 8.0.0-8.2.2
Oracle Communications WS and WEB (dom4j) 3.9m0p1 3.9.0.1
Oracle Communications Applications Core (dom4j) 7.3.0, 7.4.0 7.3.0 · 7.4.0
Oracle Construction and Engineering Web Access (dom4j) 16.1.0.0-16.2.20.1, 17.1.0.0-17.12.17.1, 18.1.0.0-18.8.19, 19.12.0-19.12.6
Oracle Enterprise Manager Application Service Level Mgmt (dom4j) 13.4.0.0 13.4.0.0
Oracle Enterprise Manager Load Testing for Web Apps (dom4j) 13.3.0.1 13.3.0.1
Oracle Financial Services Applications Bills And Collections (dom4j) 11.7, 11.8, 11.9, 11.10 11.7 · 11.8 · 11.9 · 11.10
Oracle Financial Services Applications Collections (dom4j) 2.4.0-2.10.0
Oracle Financial Services Applications Infrastructure (dom4j) 8.0.6-8.1.0
Oracle Fusion Middleware Centralized Thirdparty Jars (dom4j) 12.2.1.4.0 12.2.1.4.0
Oracle Fusion Middleware General (dom4j) 11.1.1.9.0, 12.2.1.3.0 11.1.1.9.0 · 12.2.1.3.0
Oracle Fusion Middleware Installer (dom4j) 12.2.1.3.0, 12.2.1.4.0 12.2.1.3.0 · 12.2.1.4.0
Oracle Fusion Middleware Integrator ETL (dom4j) 3.2.0 3.2.0
Oracle Fusion Middleware Oracle JDeveloper (dom4j) 12.2.1.4.0 12.2.1.4.0
Oracle Fusion Middleware Portlet Services (dom4j) 11.1.1.9.0 11.1.1.9.0 · 12.2.1.3.0 · 12.2.1.4.0
Oracle Fusion Middleware Runtime Java agent for ODI (dom4j) 12.2.1.3.0, 12.2.1.4.0 12.2.1.3.0 · 12.2.1.4.0
Oracle Health Sciences Applications Recordlocator, DSUB (dom4j) 3.0.1 3.0.1
Oracle Health Sciences Applications User Interface (dom4j) 9.0 9.0
Oracle Insurance Applications Architecture (dom4j) 10.2.0, 10.2.4, 11.0.2, 11.1.0-11.3.0 10.2.0 · 10.2.4 · 11.0.2
Oracle Insurance Applications Development tools (dom4j) 12.6.0 - 12.6.4
Oracle Retail Applications RIB Kernal (dom4j) 15.0, 16.0 15.0 · 16.0
Oracle Retail Applications Security (dom4j) 14.0.4, 14.1.3.0, 15.0.3.0, 16.0.3.0 14.0.4 · 14.1.3.0 · 15.0.3.0 · 16.0.3.0
Oracle Retail Applications Segment (dom4j) 16.0, 17.0, 18.0, 19.0 16.0 · 17.0 · 18.0 · 19.0
Oracle Retail Applications System Administration (dom4j) 15.0, 16.0, 18.0, 19.0, 19.1 15.0 · 16.0 · 18.0 · 19.0 · 19.1
Oracle Retail Applications Xenvironment (dom4j) 15.0.4, 16.0.6, 17.0.4, 18.0.3 15.0.4 · 16.0.6 · 17.0.4 · 18.0.3
Oracle Siebel CRM Application Interface (JDOM) 17.0-25.11
Oracle Supply Chain Installation Issues (dom4j) 6.2.1.0 6.2.1.0
Oracle Supply Chain Middle Tier (dom4j) 12.1, 12.2 12.1 · 12.2
Oracle Supply Chain Security (dom4j) 9.3.3, 9.3.5 9.3.3 · 9.3.5
Oracle Systems Software (dom4j) 2.3 2.3
Oracle Utilities Applications Content Acquisition System (dom4j) 2.3.0.2, 2.4.0.1, 2.5.0.0, 2.5.0.1, 2.5.0.2 2.3.0.2 · 2.4.0.1 · 2.5.0.0 · 2.5.0.1 · 2.5.0.2
Oracle Utilities Applications General (dom4j) 2.2.0.0.0, 4.2.0.2.0, 4.2.0.3.0, 4.3.0.1.0 - 4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0 2.2.0.0.0 · 4.2.0.2.0 · 4.2.0.3.0 · 4.4.0.0.0 · 4.4.0.2.0

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
org.dom4j:dom4j 0 2.0.3 unbounded
org.dom4j:dom4j 2.1.0 2.1.3 unbounded
dom4j:dom4j 0 none 1.6.1

Products and versions

40 products, 81 version entries
SourceVendorProductSchemeAffected versions
nvd canonical ubuntu linux generic 16.04
osv dom4j dom4j generic ≤ 1.6.1
nvd dom4j project dom4j generic ＜ 2.0.3 · ≥ 2.1.0 and ＜ 2.1.3
nvd netapp oncommand api services generic any version
nvd netapp oncommand workflow automation generic any version
nvd netapp snap creator framework generic any version
nvd netapp snapcenter generic any version
nvd netapp snapmanager generic any version
nvd opensuse leap generic 15.1
nvd oracle agile product lifecycle management generic 9.3.3 · 9.3.5
nvd oracle application testing suite generic 13.3.0.1
nvd oracle banking platform generic ≥ 2.4.0 and ≤ 2.10.0
nvd oracle business process management suite generic 12.2.1.3.0 · 12.2.1.4.0
nvd oracle communications application session controller generic 3.9m0p1
nvd oracle communications diameter signaling router generic ≥ 8.0.0 and ≤ 8.2.2
nvd oracle communications unified inventory management generic 7.3.0 · 7.4.0
nvd oracle data integrator generic 12.2.1.3.0 · 12.2.1.4.0
nvd oracle documaker generic ≥ 12.6.0 and ≤ 12.6.4
nvd oracle endeca information discovery integrator generic 3.2.0
nvd oracle enterprise data quality generic 11.1.1.9.0 · 12.2.1.3.0
nvd oracle enterprise manager base platform generic 13.4.0.0
nvd oracle financial services analytical applications infrastructure generic ≥ 8.0.6 and ≤ 8.1.0
nvd oracle flexcube core banking generic 11.7.0 · 11.8.0 · 11.9.0 · 11.10.0
nvd oracle fusion middleware generic 12.2.1.4.0
nvd oracle health sciences empirica signal generic 9.0
nvd oracle health sciences information manager generic 3.0.1
nvd oracle insurance policy administration j2ee generic 10.2.0 · 10.2.4 · 11.0.2 · ≥ 11.1.0 and ≤ 11.3.0
nvd oracle insurance rules palette generic 10.2.0 · 10.2.4 · 11.0.2 · ≥ 11.1.0 and ≤ 11.3.0
nvd oracle jdeveloper generic 12.2.1.4.0
nvd oracle primavera p6 enterprise project portfolio management generic ≥ 16.1.0.0 and ≤ 16.2.20.1 · ≥ 17.1.0.0 and ≤ 17.12.17.1 · ≥ 18.1.0.0 and ≤ 18.8.19.0 · ≥ 19.12.0.0 and ≤ 19.12.6.0
nvd oracle rapid planning generic 12.1 · 12.2
nvd oracle retail customer management and segmentation foundation generic 16.0 · 17.0 · 18.0 · 19.0
nvd oracle retail integration bus generic 15.0 · 16.0
nvd oracle retail order broker generic 15.0 · 16.0 · 18.0 · 19.0 · 19.1
nvd oracle retail price management generic 14.0.3 · 14.1.3.0 · 15.0.3.0 · 16.0.3.0
nvd oracle retail xstore point of service generic 15.0.4 · 16.0.6 · 17.0.4 · 18.0.3
nvd oracle storagetek tape analytics sw tool generic 2.3
nvd oracle utilities framework generic 2.2.0.0.0 · 4.2.0.2.0 · 4.2.0.3.0 · ≥ 4.3.0.1.0 and ≤ 4.3.0.6.0 · 4.4.0.0.0 · 4.4.0.2.0
nvd oracle webcenter portal generic 11.1.1.9.0 · 12.2.1.3.0 · 12.2.1.4.0
osv org.dom4j dom4j generic ＜ 2.0.3 · ≥ 2.1.0 and ＜ 2.1.3

Earlier manual review

A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.

## Manual Classification Context **Labels:** GENERAL (DOM4J), ARCHITECTURE (DOM4J), CORE (DOM4J), NO AUTH REMOTE EXPLOIT, INTEGRATOR ETL (DOM4J), RUNTIME JAVA AGENT FOR ODI (DOM4J), CENTRALIZED THIRDPARTY JARS (DOM4J), DSUB (DOM4J), RIB KERNAL (DOM4J), PORTLET SERVICES (DOM4J), MIDDLE TIER (DOM4J), INSTALLER (DOM4J), ORACLE JDEVELOPER (DOM4J), HTTP, SYSTEM ADMINISTRATION (DOM4J), XENVIRONMENT (DOM4J), IDIH (DOM4J), WEB ACCESS (DOM4J), MULTIPLE, USER INTERFACE (DOM4J), INFRASTRUCTURE (DOM4J), LOAD TESTING FOR WEB APPS (DOM4J), SOFTWARE (DOM4J), WS AND WEB (DOM4J), SEGMENT (DOM4J), APPLICATION SERVICE LEVEL MGMT (DOM4J), BILLS AND COLLECTIONS (DOM4J), COLLECTIONS (DOM4J), SECURITY (DOM4J), DEVELOPMENT TOOLS (DOM4J), RECORDLOCATOR **Products:** ORACLE JDEVELOPER, ORACLE ENTERPRISE MANAGER, ORACLE BANKING PLATFORM, ORACLE RAPID PLANNING, ORACLE FLEXCUBE CORE BANKING, ORACLE DATA INTEGRATOR, ORACLE UTILITIES FRAMEWORK, ORACLE WEBCENTER PORTAL, ORACLE FINANCIAL SERVICES APPLICATIONS, ORACLE RETAIL PRICE MANAGEMENT, ORACLE RETAIL APPLICATIONS, ORACLE INSURANCE POLICY ADMINISTRATION J2EE, ORACLE APPLICATION TESTING SUITE, ORACLE FINANCIAL SERVICES ANALYTICAL APPLICATIONS INFRASTRUCTURE, ORACLE SUPPLY CHAIN, ORACLE ENDECA INFORMATION DISCOVERY INTEGRATOR, ORACLE AGILE PLM, STORAGETEK TAPE ANALYTICS SW TOOL, ENTERPRISE MANAGER BASE PLATFORM, ORACLE CONSTRUCTION AND ENGINEERING, ORACLE COMMUNICATIONS APPLICATION SESSION CONTROLLER, ORACLE INSURANCE APPLICATIONS, ORACLE RETAIL CUSTOMER MANAGEMENT AND SEGMENTATION FOUNDATION, PRIMAVERA P6 ENTERPRISE PROJECT PORTFOLIO MANAGEMENT, ORACLE COMMUNICATIONS DIAMETER SIGNALING ROUTER (DSR), ORACLE BUSINESS PROCESS MANAGEMENT SUITE, DOM4J, ORACLE HEALTH SCIENCES INFORMATION MANAGER, ORACLE FUSION MIDDLEWARE, ORACLE RETAIL INTEGRATION BUS, ORACLE RETAIL XSTORE POINT OF SERVICE, ORACLE COMMUNICATIONS, ORACLE DOCUMAKER, ORACLE SYSTEMS, ORACLE COMMUNICATIONS UNIFIED INVENTORY MANAGEMENT, ORACLE RETAIL ORDER BROKER, ORACLE INSURANCE RULES PALETTE, ORACLE ENTERPRISE DATA QUALITY, ORACLE COMMUNICATIONS APPLICATIONS, ORACLE UTILITIES APPLICATIONS, ORACLE HEALTH SCIENCES APPLICATIONS, ORACLE HEALTH SCIENCES EMPIRICA SIGNAL

References

URLTags
https://github.com/dom4j/dom4j/issues/87 WEB
https://github.com/dom4j/dom4j/commit/1707bf3d898a8ada3b213acb0e3b38f16eaae73d WEB
https://github.com/dom4j/dom4j/commit/a8228522a99a02146106672a34c104adbda5c658 WEB
https://www.oracle.com/security-alerts/cpuoct2021.html WEB
https://www.oracle.com/security-alerts/cpuoct2020.html WEB
https://www.oracle.com/security-alerts/cpujul2022.html WEB
https://www.oracle.com/security-alerts/cpujul2020.html WEB
https://www.oracle.com/security-alerts/cpujan2022.html WEB
https://www.oracle.com/security-alerts/cpujan2021.html WEB
https://www.oracle.com/security-alerts/cpuApr2021.html WEB

Timeline
Published2020-05-01By the CVE Program.
NVD record modified2026-08-25NVD's own last-modified date for this record.
Classification created2026-11-13First commit adding this CVE's research note.
Last VRT activity2026-11-13Most recent commit touching this CVE's classification, patch or rule file.