CVE-2020-10683
dom4j: XML External Entity vulnerability in default SAX parser
Severity
ModerateRed Hat Product Security
CVSS 3.0
Review impact separately from score.
Published · April 15, 2020
Updated · August 5, 2026
Description
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.
Statement
OpenShift Container Platform ships a vulnerable version of dom4j library. However it's used to parse configuration files, which are local disk resources. We've rated this issue with a moderate impact for OpenShift Container Platform.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.0 · 7.4CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
CWE-611 · Improper Restriction of XML External Entity Reference