GHSA-jxm5-5xcw-h57q

exist-db:exist-core XML External Entity (XXE) vulnerability

Source: GitHub Advisory Database (reviewed) Critical CVE-2018-1000823

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.exist-db:exist-core	< 5.1.0	5.1.0

Details

As written in the advisory (Markdown source, shown as plain text).

exist version <= 5.0.0-RC4 contains a XML External Entity (XXE) vulnerability in XML Parser for REST Server that can result in Disclosure of confidential data, denial of service, SSRF, port scanning.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-1000823 advisory
https://github.com/eXist-db/exist/issues/2180 web
https://github.com/eXist-db/exist/pull/2243 web
https://github.com/eXist-db/exist/pull/2247 web
https://github.com/eXist-db/exist/commit/1c3f0aec14d00bdbca175713af70cb7c7b868e9f web
https://github.com/eXist-db/exist/commit/b210f9fbf379b68842f2b055dda80d7e7479e96f web
https://0dd.zone/2018/10/27/exist-XXE web
https://github.com/advisories/GHSA-jxm5-5xcw-h57q advisory
https://github.com/eXist-db/exist package