SynopsisThe remote EulerOS host is missing a security update.
DescriptionAccording to the version of the dom4j package installed, the EulerOS installation on the remote host is affected by the following vulnerability :
- dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.(CVE-2020-10683)
Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
SolutionUpdate the affected dom4j package.