Security Vulnerability in Dom4j (CVE-2018-1000632)

janusgraph-core, janusgraph-cql and janusgraph-solr indirectly depend on dom4j.

Which the dependency reflections uses.

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-1000632

**Decription**
dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or elements in the XML document. This vulnerability appears to have been fixed in 2.1.1 or later.

```
[info] dom4j:dom4j:1.6.1
[info] +-org.reflections:reflections:0.9.9-RC1
[info] +-org.janusgraph:janusgraph-core:0.3.1
[info] +-org.janusgraph:janusgraph-cql:0.3.1
[info] +-org.janusgraph:janusgraph-solr:0.3.1
```

Start by running the dependency report for janusgraph-core, janusgraph-cql, and janusgraph-solr to confirm how reflections brings in dom4j 1.6.1. Check the relevant build configuration and verify that the resolved dom4j version is at least 2.1.1 without breaking dependency resolution; rerun the dependency or security checks to confirm the vulnerable version is gone.

Written by the indexing model from the issue text.