CVE-2018-1000548 XML external entity in n/a
Attackers can exploit an XML External Entity vulnerability in Umlet to disclose confidential data or cause denial of service via crafted files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2018-1000548?
CVE-2018-1000548 is a high-severity vulnerability in n/a, published on 26 Jun 2018. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Umlet version < 14.3 contains a XML External Entity (XXE) vulnerability in File parsing that can result in disclosure of confidential data, denial of service, server side request forgery. This attack appear to be exploitable via Specially crafted UXF file. This vulnerability appears to have been fixed in 14.3.
Weakness: CWE-611
Which versions are affected by CVE-2018-1000548?
It affects 1 product.
Products include Umlet Umlet.
How do I fix CVE-2018-1000548?
Upgrade to a fixed version.
Is CVE-2018-1000548 being exploited?
There is no known exploitation of CVE-2018-1000548 in the wild and no public exploit code.
Sources
Also known as GHSA-232p-99pf-h332, UBUNTU-CVE-2018-1000548.