CVE-2018-1000652 - JabRef version <=4.3.1 contains a XML External Entity (XXE) vulnerability in MsBibImporter XML Parser that can result in disclosure of confidential data, denial of service, server side request forgery, port scanning

Back Back to CVE browser

CRITICAL

JabRef version <=4.3.1 contains a XML External Entity (XXE) vulnerability in MsBibImporter XML Parser that can result in disclosure of confidential data, denial of service, server side request forgery, port scanning

Published Aug 20, 2018

10.0

CRITICAL

CVSS 3.0

EPSS 1.94%

Description

JabRef version <=4.3.1 contains a XML External Entity (XXE) vulnerability in MsBibImporter XML Parser that can result in disclosure of confidential data, denial of service, server side request forgery, port scanning. This attack appear to be exploitable via Specially crafted MsBib file. This vulnerability appears to have been fixed in after commit 89f855d.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-611

XXE

References (2)

https://0dd.zone/2018/08/08/JabRef-XXE/
x_refsource_MISCThird Party Advisory
https://github.com/JabRef/jabref/issues/4229
x_refsource_CONFIRMIssue TrackingThird Party Advisory

Link	Providers	Tags
https://0dd.zone/2018/08/08/JabRef-XXE/		x_refsource_MISCThird Party Advisory
https://github.com/JabRef/jabref/issues/4229		x_refsource_CONFIRMIssue TrackingThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Aug 20, 2018

Updated Sep 16, 2024

Reserved Aug 20, 2018

Link CVE-2018-1000652

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2018-1000652

Red Hat

Severity n/a

Public date n/a

Links CVE-2018-1000652