CVE-2018-1000652
Last modified
CVE-2018-1000652 is a vulnerability of currently unknown severity. JabRef version <=4.3.1 contains a XML External Entity (XXE) vulnerability in MsBibImporter XML Parser that can result in disclosure of confidential data, denial of service, server side request forgery, port scanning. This attack appear to be exploitable via Specially crafted MsBib file. EPSS estimates a 1.94% chance of exploitation in the next 30 days.
Description
JabRef version <=4.3.1 contains a XML External Entity (XXE) vulnerability in MsBibImporter XML Parser that can result in disclosure of confidential data, denial of service, server side request forgery, port scanning. This attack appear to be exploitable via Specially crafted MsBib file. This vulnerability appears to have been fixed in after commit 89f855d.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Jabref | Jabref | <= 4.3.1 |
References
- https://0dd.zone/2018/08/08/JabRef-XXE/Third Party Advisory
- https://github.com/JabRef/jabref/issues/4229Issue Tracking, Third Party Advisory
- https://0dd.zone/2018/08/08/JabRef-XXE/Third Party Advisory
- https://github.com/JabRef/jabref/issues/4229Issue Tracking, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-1000652?
How severe is CVE-2018-1000652?
How do I fix CVE-2018-1000652?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-1000646LibreHealthIO LH-EHR version REL-2.0.0 contains an Authentic…
- CVE-2018-1000647LibreHealthIO lh-ehr version REL-2.0.0 contains a Authentica…
- CVE-2018-1000648LibreHealthIO lh-ehr version REL-2.0.0 contains a Authentica…
- CVE-2018-1000649LibreHealthIO lh-ehr version REL-2.0.0 contains a Authentica…
- CVE-2018-1000650LibreHealthIO lh-ehr version REL-2.0.0 contains a SQL Inject…
- CVE-2018-1000651Stroom version <5.4.5 contains a XML External Entity (XXE) v…
- CVE-2018-1000653zzcms version 8.3 and earlier contains a SQL Injection vulne…
- CVE-2018-1000654GNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13, libta…
- CVE-2018-1000655Jsish version 2.4.65 contains a CWE-476: NULL Pointer Derefe…
- CVE-2018-1000656The Pallets Project flask version Before 0.12.3 contains a C…
- CVE-2018-1000657Rust Programming Language Rust standard library version Comm…
- CVE-2018-1000658LimeSurvey version prior to 3.14.4 contains a file upload vu…
Are you affected by CVE-2018-1000652?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST