CVE-2018-1000632

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2018-1000632
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2018-1000632.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2018-1000632
Aliases
Downstream
Related
Published
2018-08-20T19:31:31.230Z
Modified
2026-02-05T05:07:05.378420Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
[none]
Details

dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or elements in the XML document. This vulnerability appears to have been fixed in 2.1.1 or later.

References

Affected packages

Git / github.com/apache/cxf

Affected ranges

Type
GIT
Repo
https://github.com/apache/cxf
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c140ed9b51593d36dffc4870d8a4ff8084f8252b

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2018-1000632.json"

Git / github.com/dom4j/dom4j

Affected ranges

Type
GIT
Repo
https://github.com/dom4j/dom4j
Events
Introduced
a4d39926ff08656e4cf86c37f3246029c4e9122b
Fixed
177069f0e96a40ddab5ab7f41519ec29e5a39652
Introduced
9b141527f6715dc2f3462cb6531ed6529a5d3008
Fixed
b408f43b5abc0b0f408819e620bd69e72248352f
Fixed
e598eb43d418744c4dbf62f647dd2381c9ce9387

Affected versions

v2.*
v2.0.0
version-2.*
version-2.0.0
version-2.0.1
version-2.0.2
version-2.1.0
version-2.1.1

Database specific

vanir_signatures 
[
    {
        "signature_type": "Function",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "src/main/java/org/dom4j/tree/QNameCache.java",
            "function": "get"
        },
        "source": "https://github.com/dom4j/dom4j/commit/e598eb43d418744c4dbf62f647dd2381c9ce9387",
        "id": "CVE-2018-1000632-35488c68",
        "digest": {
            "function_hash": "199325550788090166794109819653578629307",
            "length": 327.0
        }
    },
    {
        "signature_type": "Line",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "src/main/java/org/dom4j/Namespace.java"
        },
        "source": "https://github.com/dom4j/dom4j/commit/e598eb43d418744c4dbf62f647dd2381c9ce9387",
        "id": "CVE-2018-1000632-3bd6d515",
        "digest": {
            "line_hashes": [
                "314198188812661398941202424502439283026",
                "82741579659803731321705998136504987739",
                "151797185316034688866896672041363997013",
                "199636037147929886189862213997516158628"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Line",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "src/main/java/org/dom4j/tree/QNameCache.java"
        },
        "source": "https://github.com/dom4j/dom4j/commit/e598eb43d418744c4dbf62f647dd2381c9ce9387",
        "id": "CVE-2018-1000632-4648bb49",
        "digest": {
            "line_hashes": [
                "147422418505375895194094920885579697205",
                "168608690976820459163785128903439418592",
                "285563659170242935906162937712434995479",
                "267323759805984201773350446167363660338"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Function",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "src/main/java/org/dom4j/QName.java",
            "function": "QName"
        },
        "source": "https://github.com/dom4j/dom4j/commit/e598eb43d418744c4dbf62f647dd2381c9ce9387",
        "id": "CVE-2018-1000632-4d9be67a",
        "digest": {
            "function_hash": "275065499305021125980377239777979989974",
            "length": 193.0
        }
    },
    {
        "signature_type": "Function",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "src/main/java/org/dom4j/io/XMLWriter.java",
            "function": "escapeElementEntities"
        },
        "source": "https://github.com/dom4j/dom4j/commit/b408f43b5abc0b0f408819e620bd69e72248352f",
        "id": "CVE-2018-1000632-8fda56a5",
        "digest": {
            "function_hash": "222350788314292880775679495024051012376",
            "length": 1013.0
        }
    },
    {
        "signature_type": "Function",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "src/main/java/org/dom4j/QName.java",
            "function": "QName"
        },
        "source": "https://github.com/dom4j/dom4j/commit/e598eb43d418744c4dbf62f647dd2381c9ce9387",
        "id": "CVE-2018-1000632-91a793ae",
        "digest": {
            "function_hash": "50164286232166251017957768309715539050",
            "length": 156.0
        }
    },
    {
        "signature_type": "Line",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "src/main/java/org/dom4j/io/XMLWriter.java"
        },
        "source": "https://github.com/dom4j/dom4j/commit/b408f43b5abc0b0f408819e620bd69e72248352f",
        "id": "CVE-2018-1000632-b4384177",
        "digest": {
            "line_hashes": [
                "236725648184904110617248220882872560481",
                "223933174473266758575948796598846298948",
                "123995894774033409981594757100304515585",
                "277477800638228186424227467503674312602"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Line",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "src/main/java/org/dom4j/QName.java"
        },
        "source": "https://github.com/dom4j/dom4j/commit/e598eb43d418744c4dbf62f647dd2381c9ce9387",
        "id": "CVE-2018-1000632-b4519614",
        "digest": {
            "line_hashes": [
                "159068995644970077640297364713887969558",
                "80789274561771364052924301408417159154",
                "151816500673044903496109026899881602596",
                "59332901774669520718939558736875745473",
                "280096135076175038850825573070871643726",
                "214913607474329058805161896514755869583",
                "42351094760623045212581057695845210285",
                "168930601465629580222610550953789028778",
                "91625039504964879982004240932877008270",
                "235041418355810679284335301429235532350",
                "30821750415135255648048159171374174012",
                "85346269660141706510647755255497829709",
                "113698993995322993817647003012983568741",
                "255488862362652146981607753092155544836",
                "290124909029656121859884563217930534750",
                "261387688273661779705760898402365817095",
                "109320987176496713575563761446899179581",
                "257960915943106047139086468834030106362"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Function",
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "src/main/java/org/dom4j/Namespace.java",
            "function": "Namespace"
        },
        "source": "https://github.com/dom4j/dom4j/commit/e598eb43d418744c4dbf62f647dd2381c9ce9387",
        "id": "CVE-2018-1000632-c731c98f",
        "digest": {
            "function_hash": "206188708269763143262114288589286603567",
            "length": 138.0
        }
    }
]
source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2018-1000632.json"