CVE-2018-1000540
Last modified
CVE-2018-1000540 is a vulnerability of currently unknown severity. LoboEvolution version < 9b75694cedfa4825d4a2330abf2719d470c654cd contains a XML External Entity (XXE) vulnerability in XML Parsing when viewing the XML file in the browser that can result in disclosure of confidential data, denial of service, server side request forgery. This attack appear to be exploitable via Specially crafted XML file.. EPSS estimates a 1.22% chance of exploitation in the next 30 days.
Description
LoboEvolution version < 9b75694cedfa4825d4a2330abf2719d470c654cd contains a XML External Entity (XXE) vulnerability in XML Parsing when viewing the XML file in the browser that can result in disclosure of confidential data, denial of service, server side request forgery. This attack appear to be exploitable via Specially crafted XML file.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Loboevolution Project | Loboevolution | < 0.99.3 |
References
- https://github.com/oswetto/LoboEvolution/issues/38Exploit, Third Party Advisory
- https://github.com/oswetto/LoboEvolution/issues/38Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-1000540?
How severe is CVE-2018-1000540?
How do I fix CVE-2018-1000540?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-1000534Joplin version prior to 1.0.90 contains a XSS evolving into …
- CVE-2018-1000535lms version <= LMS_011123 contains a Local File Disclosure v…7.5
- CVE-2018-1000536Medis version 0.6.1 and earlier contains a XSS vulnerability…
- CVE-2018-1000537Marlin Firmware Marlin version 1.1.x and earlier contains a …
- CVE-2018-1000538Minio Inc. Minio S3 server version prior to RELEASE.2018-05-…
- CVE-2018-1000539Nov json-jwt version >= 0.5.0 && < 1.9.4 contains a CWE-347:…
- CVE-2018-1000541Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
- CVE-2018-1000542netbeans-mmd-plugin version <= 1.4.3 contains a XML External…
- CVE-2018-1000543Akiee version 0.0.3 contains a XSS leading to code execution…
- CVE-2018-1000544rubyzip gem rubyzip version 1.2.1 and earlier contains a Dir…9.8
- CVE-2018-1000545Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
- CVE-2018-1000546Triplea version <= 1.9.0.0.10291 contains a XML External Ent…
Are you affected by CVE-2018-1000540?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST