CVE-2018-1000830

Опубликовано: 20 дек. 2018

Источник: nvd

CVSS3: 10

CVSS2: 7.5

EPSS Низкий

Описание

XR3Player version <= V3.124 contains a XML External Entity (XXE) vulnerability in Playlist parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning.

Ссылки

https://0dd.zone/2018/10/28/xr3player-XXE/
Third Party Advisory
https://github.com/goxr3plus/XR3Player/issues/9
Issue Tracking
Third Party Advisory
https://0dd.zone/2018/10/28/xr3player-XXE/
Third Party Advisory
https://github.com/goxr3plus/XR3Player/issues/9
Issue Tracking
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:xr3player_project:xr3player:*:*:*:*:*:*:*:*

Версия до 3.124 (включая)

EPSS

Процентиль: 48%

0.00245

Низкий

10 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-611

Связанные уязвимости

GHSA-gxp6-8fp7-592p