CVE-2018-1000632: XML Injection vulnerability in dom4j
Summary
CVE-2018-1000632: Dom4j contains a XML Injection vulnerability. Affects org.dom4j:dom4j across 2 version ranges.
< 2.0.3
>= 2.1.0, < 2.1.1
Fixed in 2.0.3 or 2.1.1, depending on the release line you run. How to fix ↓
Also tracked for
- dom4j · Debian:11
The same CVE-2018-1000632 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
dom4j is an open-source library for working with XML documents in Java. It provides a flexible and easy-to-use API for parsing, manipulating, and generating XML. The library is widely used in various Java applications and frameworks. However, versions prior to 2.1.1 are vulnerable to XML Injection.
Vulnerability Detail
The XML Injection vulnerability in dom4j (CWE-91) exists in the Element class methods addElement and addAttribute. This vulnerability allows an attacker to tamper with XML documents by injecting malicious attributes or elements. By exploiting this vulnerability, an attacker can manipulate the structure and content of XML documents, potentially leading to various security risks and data integrity issues.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.0.32.0.3 -
>= 2.1.0, < 2.1.12.1.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. Upgrading to the fixed version is the recommended solution.
Conclusion
The XML Injection vulnerability in dom4j can be mitigated by upgrading to version 2.1.1 or later of the org.dom4j:dom4j package. It is crucial to promptly address this vulnerability to ensure the security and integrity of XML documents in your application. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.dom4j:dom4j →
FAQ
XML Injection is a type of attack where an attacker injects malicious content into an XML document, potentially altering its structure or behavior.
XML Injection can lead to various security risks, including unauthorized access, data manipulation, denial of service, and information disclosure.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file.
No, versions 2.1.1 and later of the org.dom4j:dom4j package are not affected by this vulnerability. It is recommended to upgrade to the latest version.
Yes, upgrading to version 2.1.1 or later of the org.dom4j:dom4j package fixes this vulnerability. Update the dependency in your project's pom.xml file.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.dom4j:dom4j.
