CVE-2020-10683: canonical ubuntu_linux
Modified
AliasesMGASA-2021-0034SUSE-SU-2020:1382-1SUSE-SU-2020:1383-1UBUNTU-CVE-2020-10683USN-4575-1DEBIAN-CVE-2020-10683DLA-2191-1openSUSE-SU-2020:0719-1CGA-2j26-r4r9-7m85CGA-2jmw-qf9f-vxp6CGA-33r3-58r3-r4j8CGA-36g8-7qvr-v2cmCGA-3cpm-r26v-97h2CGA-3q29-9vmg-vxf2CGA-3v3p-g567-56pqCGA-3v99-crxr-65xqCGA-3w9g-v3vq-53pvCGA-3wvx-xgpf-h36pCGA-45j9-mg32-gcrqCGA-4pmc-55wf-jc7pCGA-54w5-8j4f-4j8qCGA-5mrx-rrqc-x592CGA-5mwh-78ph-v2g7CGA-5xv7-2rf3-63jmCGA-63j8-hjpf-vvgxCGA-65rg-m2qv-g3hhCGA-6mvq-rp7p-g9cxCGA-73hv-ccwq-29wvCGA-759q-2x26-75ggCGA-76hm-mq25-75h7CGA-797h-4pc4-cj5rCGA-88xj-cqj5-324cCGA-8hrx-rgv9-7j6vCGA-93q5-62w4-m26cCGA-c3vg-564f-qqr4CGA-c85c-2xmq-pjr9CGA-c8rj-h79c-96rwCGA-cj9p-qg68-vh8jCGA-f6cj-j372-v867CGA-f6hf-pq56-7hg4CGA-fh8g-mjr6-6q3rCGA-fqqq-3mh5-98v3CGA-fqr6-rmqm-xf6pCGA-g337-r7ww-92g7CGA-g9jw-7g4c-8v4qCGA-gf2v-mf69-54g2CGA-gmv8-vr4g-h9rgCGA-h3jv-m8qv-rwfjCGA-h5p4-9j97-5w7gCGA-h7mv-3jqm-mp6fCGA-hcxx-xjfh-75ppCGA-hggg-v78p-2vcxCGA-j22j-4wgq-929xCGA-j3gc-3fg9-v3j6CGA-j3wm-v497-79m6CGA-jfcx-q7m9-42vqCGA-jgh4-66x6-qh8wCGA-jr73-p3h9-vmwmCGA-m3h6-265f-g7hjCGA-m9hm-gqhv-rqqrCGA-mgfq-cjj7-98pmCGA-p3hr-4p7g-4f6qGHSA-hwj3-m3p6-hj38CGA-q8v2-g94v-rjmgCGA-qqw5-48q4-6hjxCGA-qv2m-whm8-7m75CGA-rhp8-2v22-w945CGA-rvh2-76xc-rxqcCGA-rx24-xxp5-473vCGA-v3jp-cj4h-6v48CGA-v9vr-pgxg-756fCGA-w6hj-8grj-j9j8CGA-x2mm-x5c8-5hmpCGA-x7g4-792r-xv67CGA-x9mr-mr68-2f95
Published 01-05-2020Last modified 04-08-2024
Vulnerability summary
CVE-2020-10683 is a critical (CVSS 9.8) vulnerability in canonical ubuntu_linux. EPSS estimates a 7.27% chance of exploitation in the next 30 days, higher than 94.3% of scored vulnerabilities.
Priority
Prioritisesevere
Severe, CVSS 9.8 (NVD); no exploitation reported by the 5 checked sources; EPSS 7% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?CVSS score
9.8/10
010
Critical · v3.1 (NVD)EPSS score
7.27%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 7 · Related 1Timeline
- 01-05-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.
CVSS metrics
6 scores · 5 sources · 2 versionsCritical 9.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 5 agree
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · MavenEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
High 7.5Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
7.27%
Chance of exploitation in the next 30 days
Percentile
94%
Versus all other CVEs
30-day change
No change 0.00 pp
From 7.27% on 04-10-2026
04-10-202603-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Version check
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard30 products
- eco-java-gradle-1.11All versions (No fix recorded)
- eco-java-gradle-2.0All versions (No fix recorded)
- eco-java-gradle-2.1All versions (No fix recorded)
- eco-java-gradle-2.10All versions (No fix recorded)
- eco-java-gradle-2.11All versions (No fix recorded)
Oracle30 products
- agile_product_lifecycle_management9.3.3 | 9.3.5
- application_testing_suite13.3.0.1
- banking_platform≥ 2.4.0, ≤ 2.10.0
- business_process_management_suite12.2.1.3.0 | 12.2.1.4.0
- communications_application_session_controller3.9m0p1
Netapp5 products
Opensuse2 products
- leapEOL15.1
- dom4j&distro=openSUSE Leap 15.1< 1.6.1-lp151.6.3.1
Suse2 products
- dom4j&distro=SUSE Manager Server 3.2< 1.6.1-27.7.2
- dom4j&distro=SUSE Manager Server Module 4.0< 1.6.1-4.9.4
Canonical1 product
- ubuntu_linuxEOL16.04
Debian1 product
- dom4j< 1.6.1+dfsg.3-2+deb8u2 | < 2.1.3-1
Dom4j1 product
- dom4j≤ 1.6.1
Dom4j_project1 product
- dom4j< 2.0.3 | ≥ 2.1.0, < 2.1.3
Mageia1 product
- dom4j< 2.0.0-4.1.mga7
Org.dom4j1 product
- dom4j< 2.0.3 | ≥ 2.1.0, < 2.1.3
Ubuntu1 product
- dom4jAll versions (No fix recorded) | < 1.6.1+dfsg.3-2ubuntu1.1
12 vendors · 76 products
References
40 links- lists.opensuse.org/opensuse-security-announce/2020-05/msg00061.htmlVendor AdvisoryX Refsource SUSEAdvisoryWEBThird Party Advisory
- cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.htmlX Refsource MISCAdvisoryWEBThird Party Advisory
- bugzilla.redhat.com/show_bug.cgi?id=1694235X Refsource MISCFIXWEBIssue TrackingPatchThird Party Advisory
- github.com/dom4j/dom4j/releases/tag/version-2.1.3X Refsource CONFIRMAdvisoryWEBRelease NotesThird Party Advisory
- github.com/dom4j/dom4j/commit/a8228522a99a02146106672a34c104adbda5c658X Refsource CONFIRMREPORTFIXWEBPatchThird Party Advisory
Show all 40 references
- lists.opensuse.org/archives/…Advisory
- github.com/dom4j/dom4jPACKAGE