CVE-2020-10683 @ Maven-dom4j:dom4j-1.6.1

[AaronZhouYu]

Vulnerable Package issue exists @ Maven-dom4j:dom4j-1.6.1 in branch main

dom4j before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.

Namespace: AaronZhouYu
Repository: TotallySecureApp
Repository Url: https://github.com/AaronZhouYu/TotallySecureApp
CxAST-Project: AaronZhouYu/TotallySecureApp
CxAST platform scan: 044c3806-8e67-4c10-99a5-5e39d680a811
Branch: main
Application: TotallySecureApp
Severity: HIGH
State: NOT_IGNORED
Status: RECURRENT
CWE: CWE-611

---

Additional Info
Attack vector: NETWORK
Attack complexity: LOW
Confidentiality impact: HIGH
Availability impact: HIGH

---

References
Advisory
Mail Thread
Release Note
Advisory
Commit