返回 CVE 浏览器

CVE-2018-1000651

CRITICAL

10.0

CVSS Severity Score

EPSS Score0.1910%

EPSS Percentile41.62th

Published2018年8月20日

Last Modified2024年11月21日

Vulnerability Description

Stroom version <5.4.5 contains a XML External Entity (XXE) vulnerability in XML Parser that can result in disclosure of confidential data, denial of service, server side request forgery, port scanning. This attack appear to be exploitable via Specially crafted XML file.

Affected Platforms (CPE)

📦

Gchq

Stroom

< 5.4.5

References & Advisories

🔗 https://0dd.zone/2018/08/08/stroom-XXE/

🔗 https://github.com/gchq/stroom/issues/813

🔗 https://0dd.zone/2018/08/08/stroom-XXE/

🔗 https://github.com/gchq/stroom/issues/813

相关漏洞威胁

CVE-2019-107796.1

All versions of stroom:stroom-app before 5.5.12 and all versions of the 6.0.0 branch before 6.0.25 are affected by Cross-site Scri...

CVE-2018-1051110.0

A vulnerability in Trend Micro Control Manager (versions 6.0 and 7.0) could allow an attacker to conduct a server-side request for...

CVE-2018-377410.0

Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, ...

CVE-2018-100065210.0

JabRef version <=4.3.1 contains a XML External Entity (XXE) vulnerability in MsBibImporter XML Parser that can result in disclosur...