CVE-2018-1000823

moderate-risk
Published 2018-12-20

exist version <= 5.0.0-RC4 contains a XML External Entity (XXE) vulnerability in XML Parser for REST Server that can result in Disclosure of confidential data, denial of service, SSRF, port scanning.

Do I need to act?

-
0.24% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
+
Fix available
Upgrade to: 5a27d10ba1710c1df751344b53ac6e4cb4778e3b
10
CVSS 10.0/10 Critical
NETWORK / LOW complexity

Affected Products (5)

Exist
Exist
Exist
Exist
Exist

Affected Vendors

Exist-Db

References (4)

Third Party Advisory https://0dd.zone/2018/10/27/exist-XXE/
Issue Tracking https://github.com/eXist-db/exist/issues/2180
Third Party Advisory https://0dd.zone/2018/10/27/exist-XXE/
Issue Tracking https://github.com/eXist-db/exist/issues/2180
46
/ 100
moderate-risk
Severity 33/34 · Critical
Exploitability 1/34 · Minimal
Exposure 12/34 · Low