CVE-2018-1000632: Input Validation
dom4j could allow a remote attacker to execute arbitrary code on the system, caused by improper input validation in multiple methods. By sending a specially-crafted XML content, an attacker could exploit this vulnerability to execute arbitrary code on the system.
Other sources
dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or elements in the XML document. This vulnerability appears to have been fixed in 2.1.1 or later.
— MITRE
XML Injection vulnerability was found in dom4j in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or elements in the XML document.
Upstream issue:
https://github.com/dom4j/dom4j/issues/48
Upstream patch:
https://github.com/dom4j/dom4j/commit/e598eb43d418744c4dbf62f647dd2381c9ce9387
References:
https://ihacktoprotect.com/post/dom4j-xml-injection/
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2018-1000632.
What is the severity of CVE-2018-1000632?
The severity of CVE-2018-1000632 is high with a CVSS score of 7.3.
What is dom4j?
dom4j is a Java library for working with XML.
How can a remote attacker exploit CVE-2018-1000632?
A remote attacker can exploit CVE-2018-1000632 by sending a specially-crafted XML content.
How can CVE-2018-1000632 be fixed?
CVE-2018-1000632 can be fixed by updating dom4j to version 2.0.3 or 2.1.1, depending on the affected software.