CVE-2018-1000632

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2018-1000632
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2018-1000632.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2018-1000632
Aliases
Downstream
Related
Published
2018-08-20T19:31:31.230Z
Modified
2026-02-24T11:24:38.123389Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
[none]
Details

dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or elements in the XML document. This vulnerability appears to have been fixed in 2.1.1 or later.

References

Affected packages

Git / github.com/dom4j/dom4j

Affected ranges

Type
GIT
Repo
https://github.com/dom4j/dom4j
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e598eb43d418744c4dbf62f647dd2381c9ce9387
Introduced
9b141527f6715dc2f3462cb6531ed6529a5d3008
Fixed
b408f43b5abc0b0f408819e620bd69e72248352f
Introduced
a4d39926ff08656e4cf86c37f3246029c4e9122b
Fixed
177069f0e96a40ddab5ab7f41519ec29e5a39652

Affected versions

version-2.*
version-2.1.0

Database specific

vanir_signatures 
[
    {
        "signature_type": "Function",
        "digest": {
            "length": 327.0,
            "function_hash": "199325550788090166794109819653578629307"
        },
        "signature_version": "v1",
        "target": {
            "function": "get",
            "file": "src/main/java/org/dom4j/tree/QNameCache.java"
        },
        "source": "https://github.com/dom4j/dom4j/commit/e598eb43d418744c4dbf62f647dd2381c9ce9387",
        "id": "CVE-2018-1000632-35488c68",
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "314198188812661398941202424502439283026",
                "82741579659803731321705998136504987739",
                "151797185316034688866896672041363997013",
                "199636037147929886189862213997516158628"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "target": {
            "file": "src/main/java/org/dom4j/Namespace.java"
        },
        "source": "https://github.com/dom4j/dom4j/commit/e598eb43d418744c4dbf62f647dd2381c9ce9387",
        "id": "CVE-2018-1000632-3bd6d515",
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "147422418505375895194094920885579697205",
                "168608690976820459163785128903439418592",
                "285563659170242935906162937712434995479",
                "267323759805984201773350446167363660338"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "target": {
            "file": "src/main/java/org/dom4j/tree/QNameCache.java"
        },
        "source": "https://github.com/dom4j/dom4j/commit/e598eb43d418744c4dbf62f647dd2381c9ce9387",
        "id": "CVE-2018-1000632-4648bb49",
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "digest": {
            "length": 193.0,
            "function_hash": "275065499305021125980377239777979989974"
        },
        "signature_version": "v1",
        "target": {
            "function": "QName",
            "file": "src/main/java/org/dom4j/QName.java"
        },
        "source": "https://github.com/dom4j/dom4j/commit/e598eb43d418744c4dbf62f647dd2381c9ce9387",
        "id": "CVE-2018-1000632-4d9be67a",
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "digest": {
            "length": 1013.0,
            "function_hash": "222350788314292880775679495024051012376"
        },
        "signature_version": "v1",
        "target": {
            "function": "escapeElementEntities",
            "file": "src/main/java/org/dom4j/io/XMLWriter.java"
        },
        "source": "https://github.com/dom4j/dom4j/commit/b408f43b5abc0b0f408819e620bd69e72248352f",
        "id": "CVE-2018-1000632-8fda56a5",
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "digest": {
            "length": 156.0,
            "function_hash": "50164286232166251017957768309715539050"
        },
        "signature_version": "v1",
        "target": {
            "function": "QName",
            "file": "src/main/java/org/dom4j/QName.java"
        },
        "source": "https://github.com/dom4j/dom4j/commit/e598eb43d418744c4dbf62f647dd2381c9ce9387",
        "id": "CVE-2018-1000632-91a793ae",
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "236725648184904110617248220882872560481",
                "223933174473266758575948796598846298948",
                "123995894774033409981594757100304515585",
                "277477800638228186424227467503674312602"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "target": {
            "file": "src/main/java/org/dom4j/io/XMLWriter.java"
        },
        "source": "https://github.com/dom4j/dom4j/commit/b408f43b5abc0b0f408819e620bd69e72248352f",
        "id": "CVE-2018-1000632-b4384177",
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "159068995644970077640297364713887969558",
                "80789274561771364052924301408417159154",
                "151816500673044903496109026899881602596",
                "59332901774669520718939558736875745473",
                "280096135076175038850825573070871643726",
                "214913607474329058805161896514755869583",
                "42351094760623045212581057695845210285",
                "168930601465629580222610550953789028778",
                "91625039504964879982004240932877008270",
                "235041418355810679284335301429235532350",
                "30821750415135255648048159171374174012",
                "85346269660141706510647755255497829709",
                "113698993995322993817647003012983568741",
                "255488862362652146981607753092155544836",
                "290124909029656121859884563217930534750",
                "261387688273661779705760898402365817095",
                "109320987176496713575563761446899179581",
                "257960915943106047139086468834030106362"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "target": {
            "file": "src/main/java/org/dom4j/QName.java"
        },
        "source": "https://github.com/dom4j/dom4j/commit/e598eb43d418744c4dbf62f647dd2381c9ce9387",
        "id": "CVE-2018-1000632-b4519614",
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "digest": {
            "length": 138.0,
            "function_hash": "206188708269763143262114288589286603567"
        },
        "signature_version": "v1",
        "target": {
            "function": "Namespace",
            "file": "src/main/java/org/dom4j/Namespace.java"
        },
        "source": "https://github.com/dom4j/dom4j/commit/e598eb43d418744c4dbf62f647dd2381c9ce9387",
        "id": "CVE-2018-1000632-c731c98f",
        "deprecated": false
    }
]
source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2018-1000632.json"

Git / github.com/qos-ch/slf4j

Affected ranges

Type
GIT
Repo
https://github.com/qos-ch/slf4j
Events
Introduced
0614d467d7bca81724f45e228f4f871161222b51
Fixed
b2cb05f16acc21a3266a74ef5c578f2cd9efdead

Affected versions

v_2.*
v_2.0.0
v_2.0.1
v_2.0.2

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2018-1000632.json"