Lucene search
IBME64AB3ADC23B600EA6ED20359A0A41DC683503D7E0E0C1B0EA08877FC18ADCD0HistoryApr 16, 2021 - 6:03 a.m.
Security Bulletin: dom4j Vulnerability in Apache Solr shipped with IBM Operations Analytics - Log Analysis Analysis (CVE-2018-1000632)
2021-04-1606:03:16
www.ibm.com
21
dom4j
xml injection
apache solr
ibm operations analytics
log analysis
cve-2018-1000632
vulnerability
remote code execution
improper input validation
patch
upgrade
EPSS
0.003
Percentile
70.9%
Summary
There is an XML Injection vulnerability in dom4j that affects Apache Solr.
Vulnerability Details
CVEID:CVE-2018-1000632
**DESCRIPTION:**dom4j could allow a remote attacker to execute arbitrary code on the system, caused by improper input validation in multiple methods. By sending a specially-crafted XML content, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base score: 7.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/148750 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| Log Analysis | 1.3.1 |
| Log Analysis | 1.3.2 |
| Log Analysis | 1.3.3 |
| Log Analysis | 1.3.4 |
| Log Analysis | 1.3.5 |
| Log Analysis | 1.3.6 |
Remediation/Fixes
| Principal Product and Version(s) : | Fix details |
|---|---|
| IBM Operations Analytics - Log Analysis version 1.3.x | Upgrade to Log Analysis version 1.3.7 |
| Download the 1.3.7-TIV-IOALA-FP here |
Workarounds and Mitigations
None
Related
veracode
veracode
XML External Entity (XXE)
2018-08-21 09:14:23
openvas
openvas
Fedora: Security Advisory for dom4j (FEDORA-2021-8015a8cdc4)
2021-05-13 00:00:00
Huawei EulerOS: Security Advisory for dom4j (EulerOS-SA-2019-1960)
2020-01-23 00:00:00
Huawei EulerOS: Security Advisory for dom4j (EulerOS-SA-2019-2569)
2020-01-23 00:00:00
osv
osv
dom4j - security update
2018-09-24 00:00:00
CVE-2018-1000632
2018-08-20 19:31:31
dom4j vulnerability
2020-11-05 16:09:57
debian
debian
[SECURITY] [DLA 1517-1] dom4j security update
2018-09-24 18:11:01
cve
cve
CVE-2018-1000632
2018-08-20 19:31:31
nessus
nessus
openSUSE Security Update : dom4j (openSUSE-2018-1077)
2018-10-01 00:00:00
Ubuntu 16.04 LTS : dom4j vulnerability (USN-4619-1)
2020-11-06 00:00:00
EulerOS 2.0 SP5 : dom4j (EulerOS-SA-2019-1960)
2019-09-23 00:00:00
mageia
mageia
Updated dom4j packages fix security vulnerability
2019-02-14 11:38:16
ibm
ibm
ubuntucve
ubuntucve
CVE-2018-1000632
2018-08-20 00:00:00
debiancve
debiancve
CVE-2018-1000632
2018-08-20 19:31:31
prion
prion
Input validation
2018-08-20 19:31:00
suse
suse
Security update for dom4j (moderate)
2018-12-08 00:22:56
Security update for dom4j (moderate)
2018-09-28 12:13:53
Security update for dom4j (moderate)
2018-12-07 12:12:51
nvd
nvd
CVE-2018-1000632
2018-08-20 19:31:31
fedora
fedora
[SECURITY] Fedora 34 Update: dom4j-2.0.3-1.fc34
2021-05-12 05:44:36
[SECURITY] Fedora 33 Update: dom4j-2.0.3-1.fc33
2021-05-12 16:13:28
redhatcve
redhatcve
CVE-2018-1000632
2020-03-16 07:35:07
cvelist
cvelist
CVE-2018-1000632
2018-08-20 19:00:00
github
github
Dom4j contains a XML Injection vulnerability
2018-10-16 17:01:25
ubuntu
ubuntu
dom4j vulnerability
2020-11-05 00:00:00
rosalinux
rosalinux
Advisory ROSA-SA-2024-2454
2024-07-23 11:11:06
redhat
redhat
atlassian
atlassian
hp
hp
HP Device Manager Security Updates
2023-10-20 00:00:00
oracle
oracle
Oracle Critical Patch Update Advisory - January 2019
2019-01-15 00:00:00
Oracle Critical Patch Update Advisory - April 2021
2021-04-20 00:00:00
Oracle Critical Patch Update Advisory - July 2020
2020-07-14 00:00:00
EPSS
0.003
Percentile
70.9%
Related for E64AB3ADC23B600EA6ED20359A0A41DC683503D7E0E0C1B0EA08877FC18ADCD0