Uploaded image for project: 'mod-data-import'
  1. mod-data-import
  2. MODDATAIMP-319

Dom4j XXE vulnerability (CVE-2020-10683)

    XMLWordPrintable

Details

    • Bug
    • Status: Closed (View Workflow)
    • P1
    • Resolution: Done
    • 1.10.1
    • 1.10.2
    • Folijet Sprint 93
    • 0.5
    • Folijet
    • Q2 2020 Hot Fix #1

    Description

      Dom4j's SAXReader enables external DTDs and External Entities by default when reading XML files.

      This makes mod-data-import vulnerable to XXE attacks: https://en.wikipedia.org/wiki/XML_external_entity_attack

      Task:

      Upgrade to latest Dom4j and disable external DTDs and External Entities by changing the SAXReader configuration as suggested on
      https://github.com/dom4j/dom4j/releases/tag/version-2.1.3
      https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#saxreader

      Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10683

      TestRail: Results

        Attachments

          Issue Links

            defines

            New Feature - New feature requests UXPROD-2551 NFR: Data Import (Batch Importer for Bib Acq) & PubSub Q3 2020 Technical, NFR, & Misc bug work

            • P2 - normal priority level, must be included in the current development cycle
            • Closed
            has to be done before

            Story - Created by Jira Software - do not edit or delete. Issue type for a user story. MODDATAIMP-320 Release mod-data-import 1.10.2

            • P1 - highest priority item, drop everything else before this is resolved, reserved for critical bugfixes
            • Closed

            Activity

              People

                Kateryna Senchenko Kateryna Senchenko
                julianladisch Julian Ladisch
                Votes:
                0 Vote for this issue
                Watchers:
                1 Start watching this issue

                Dates

                  Created:
                  Updated:
                  Resolved:

                  TestRail: Runs

                    TestRail: Cases