CVE-2018-1000823 exist-db:exist-core XML External Entity (XXE) vulnerability
An XML External Entity vulnerability in the Exist REST Server allows attackers to disclose confidential data, cause denial of service, or perform SSRF.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-1000823?
CVE-2018-1000823 is a critical vulnerability in n/a, published on 20 Dec 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
exist version <= 5.0.0-RC4 contains a XML External Entity (XXE) vulnerability in XML Parser for REST Server that can result in Disclosure of confidential data, denial of service, SSRF, port scanning.
Weakness: CWE-611
Which versions are affected by CVE-2018-1000823?
2 open source packages ship an affected version, including org.exist-db:exist-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.exist-db:exist-core Maven | All versions | 5.1.0 |
org.exist-db:exist-core Maven | All versions | 5.1.0 |
Products include Exist-Db Exist.
How do I fix CVE-2018-1000823?
Upgrade org.exist-db:exist-core to 5.1.0 or later.
Is CVE-2018-1000823 being exploited?
There is no known exploitation of CVE-2018-1000823 in the wild and no public exploit code.
Sources
Also known as GHSA-jxm5-5xcw-h57q.