[ https://issues.redhat.com/browse/WFLY-13380?page=com.atlassian.jira.plugi... ] Radoslav Ivanov commented on WFLY-13380: ---------------------------------------- [~brian.stansberry], there is a critical CVE-2020-10683 reported for dom4j-2.1.1, which is available on previous versions of WildFly. It could be mitigated by "enabling safe bahavior": {code:java} dom4j before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j. {code} Could you please provide a note/instruction on how we can apply/mitigate on existing older versions of WildFly? -- This message was sent by Atlassian Jira (v7.13.8#713008)