CVE-2018-1000822

codelibs fess version before commit faa265b contains a XML External Entity (XXE) vulnerability in GSA XML file parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via specially crafted GSA XML files. This vulnerability appears to have been fixed in after commit faa265b.

• CWE-611

• https://0dd.zone/2018/10/27/fess-XXE/Third Party Advisory
• https://github.com/codelibs/fess/issues/1851Issue Tracking, Patch, Third Party Advisory
• https://0dd.zone/2018/10/27/fess-XXE/Third Party Advisory
• https://github.com/codelibs/fess/issues/1851Issue Tracking, Patch, Third Party Advisory

Published

Dec 20, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-1000816Grafana version confirmed for 5.2.4 and 5.3.0 contains a Cro…
• CVE-2018-1000817Asset Pipeline Grails Plugin Asset-pipeline plugin version P…
• CVE-2018-1000818Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2018-1000819Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2018-1000820neo4j-contrib neo4j-apoc-procedures version before commit 45…
• CVE-2018-1000821MicroMathematics version before commit 5c05ac8 contains a XM…
• CVE-2018-1000823exist version <= 5.0.0-RC4 contains a XML External Entity (X…10
• CVE-2018-1000824MegaMek version < v0.45.1 contains a Other/Unknown vulnerabi…
• CVE-2018-1000825FreeCol version <= nightly-2018-08-22 contains a XML Externa…
• CVE-2018-1000826Microweber version <= 1.0.7 contains a Cross Site Scripting …
• CVE-2018-1000827Ubilling version <= 0.9.2 contains a Other/Unknown vulnerabi…
• CVE-2018-1000828FrostWire version <= frostwire-desktop-6.7.4-build-272 conta…9