CVE-2018-1000632
CVSS v3
7.5
HIGH
EPSS Score
6.6 %
exploit probability, as of 2026-10-05
CISA KEV
No
known exploited
Exploitation
—
SSVC status
Description
dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or elements in the XML document. This vulnerability appears to have been fixed in 2.1.1 or later.
Technical details
- Published
- 2018-08-20
Frequently asked questions
What is CVE-2018-1000632?
dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or elements in the XML document. This vulnerability appears to have been fixed in 2.1.1 or later.
Is CVE-2018-1000632 actively exploited?
Active exploitation of CVE-2018-1000632 has not been confirmed. Its EPSS score was 6.6% on 2026-10-05, the estimated probability of exploitation in the next 30 days.
What is the CVSS score for CVE-2018-1000632?
CVE-2018-1000632 has a CVSS v3 base score of 7.5 (HIGH severity).
Is CVE-2018-1000632 affecting your environment?
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.
No credit card required · 50 free checks/month · Free API key
Other 2018 vulnerabilities worth triaging
Ranked by exploit probability (EPSS).