CVE-2018-1000825 XML external entity in n/a
An attacker can exploit an XML External Entity vulnerability in FreeCol to disclose confidential data or cause denial of service via a malicious file.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-1000825?
CVE-2018-1000825 is a critical vulnerability in n/a, published on 20 Dec 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
FreeCol version <= nightly-2018-08-22 contains a XML External Entity (XXE) vulnerability in FreeColXMLReader parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via Freecol file.
Weakness: CWE-611
Which versions are affected by CVE-2018-1000825?
It affects 1 product.
Products include Freecol Freecol.
How do I fix CVE-2018-1000825?
Upgrade to a fixed version.
Is CVE-2018-1000825 being exploited?
There is no known exploitation of CVE-2018-1000825 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2018-1000825, GHSA-7g3h-g9h9-3g4r, UBUNTU-CVE-2018-1000825.