CVE-2018-1000835

Опубликовано: 20 дек. 2018

Источник: nvd

CVSS3: 10

CVSS2: 7.5

EPSS Низкий

Описание

KeePassDX version <= 2.5.0.0beta17 contains a XML External Entity (XXE) vulnerability in kdbx file parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning.

Ссылки

https://0dd.zone/2018/10/28/KeePassDX-XXE/
Third Party Advisory
https://github.com/Kunzisoft/KeePassDX/issues/200
Issue Tracking
Third Party Advisory
https://0dd.zone/2018/10/28/KeePassDX-XXE/
Third Party Advisory
https://github.com/Kunzisoft/KeePassDX/issues/200
Issue Tracking
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta1:*:*:*:*:*:*

cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta10:*:*:*:*:*:*

cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta11:*:*:*:*:*:*

cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta12:*:*:*:*:*:*

cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta13:*:*:*:*:*:*

cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta14:*:*:*:*:*:*

cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta15:*:*:*:*:*:*

cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta16:*:*:*:*:*:*

cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta17:*:*:*:*:*:*

cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta2:*:*:*:*:*:*

cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta3:*:*:*:*:*:*

cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta4:*:*:*:*:*:*

cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta5:*:*:*:*:*:*

cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta6:*:*:*:*:*:*

cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta7:*:*:*:*:*:*

cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta8:*:*:*:*:*:*

cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta9:*:*:*:*:*:*

EPSS

Процентиль: 47%

0.00245

Низкий

10 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-611

Связанные уязвимости

GHSA-9qcx-vmqv-xpff