Attacker Value
Unknown
CVE-2018-1000632
CVE-2018-1000632
(Last updated November 08, 2023) ▾
MITRE ATT&CK
Log in to add MITRE ATT&CK tag
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
Description
dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or elements in the XML document. This vulnerability appears to have been fixed in 2.1.1 or later.
Add Assessment
No one has assessed this topic. Be the first to add your voice to the community.
CVSS V3 Severity and Metrics
Data provided by the National Vulnerability Database (NVD)
Base Score:
7.5 High
Impact Score:
3.6
Exploitability Score:
3.9
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
None
Integrity (I):
High
Availability (A):
None
General Information
Products
- debian linux 8.0
- dom4j
- flexcube investor servicing 12.0.4
- flexcube investor servicing 12.1.0
- flexcube investor servicing 12.3.0
- flexcube investor servicing 12.4.0
- flexcube investor servicing 14.0.0
- jboss enterprise application platform 6.0.0
- jboss enterprise application platform 6.4.0
- jboss enterprise application platform 7.1.0
- oncommand workflow automation
- primavera p6 enterprise project portfolio management
- rapid planning 12.1
- rapid planning 12.2
- retail integration bus 15.0
- retail integration bus 16.0
- satellite 6.6
- satellite capsule 6.6
- snap creator framework
- snapcenter
- snapmanager
- utilities framework
- utilities framework 2.2.0
- utilities framework 4.2.0.2.0
- utilities framework 4.2.0.3.0
- utilities framework 4.4.0.0.0
- utilities framework 4.4.0.2
References
Advisory
