GHSA-FGQ9-FC3Q-VQMW Withdrawn Advisory: dom4j XML Entity Expansion vulnerability

Withdrawn Advisory This advisory has been withdrawn because the underlying vulnerability could not be reproduced. This link is maintained to preserve external references. Original Description An issue in dom4.j org.dom4.io.SAXReader v.2.1.4 and before allows a remote attacker to obtain sensitive...

CVE-2023-45960

Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

PT-2023-29776 · Org.Dom4J · Org.Dom4J

Name of the Vulnerable Software and Affected Versions: org.dom4j SAXReader versions 2.1.4 and before Description: The issue allows a remote attacker to obtain sensitive information via the setFeature function. However, it's noted that the underlying vulnerability could not be reproduced...

in dotcms/core

Description Hello, dotCMS has an XXE vulnerability in the template design page. To exploit this flaw, a attacker needs the permission to edit and preview templates, and this can be abused to read internal files Video Poc This section of the documentation explain how to use the XMLTool in the...

Updated dom4j packages fix a security vulnerability

A flaw was found in the dom4j library. By using the default SaxReader provided by Dom4J, external DTDs and External Entities are allowed, resulting in a possible XXE CVE-2020-10683...

XML External Entity

dom4j is vulnerable to XML external entity attacks. The default SaxReader does not disable external DTDs and External Entities by default, allowing an attacker to access local or internal network resources, or perform requests on behalf of the server...

XML External Entity (XXE) Injection Through Insecure Defaults

dom4j is vulnerable to XML External Entity Injection. The library by default uses the SAXReader to parse documents without using the setFeature function in it to disable doctype and entities, allowing a malicious user to pass a document to execute an XML Injection attack...

CVE-2023-45960

CVE-2023-45960 refers to a dom4j SAXReader vulnerability where improper handling of XML external entity (XXE) declarations in the setFeature function could allow a remote attacker to obtain sensitive information. Documented by IBM for InfoSphere Information Server 11.7 as affected, with remediati...

CVE-2023-45960

Removed by vendor...