exist-db:exist-core XML External Entity (XXE) vulnerability

CRITICAL 10.0CVE-2018-1000823 · GHSA-jxm5-5xcw-h57q · Published 20/12/2018 · updated 17/06/2026

In short

CVE-2018-1000823 is a CRITICAL (CVSS 10.0) vulnerability affecting org.exist-db:exist-core, exist (exist-db).
Chance of exploitation in the next 30 days (EPSS): 1.9%, higher than 79.6% of all vulnerabilities.
Fix: update to 5.1.0, 5.0.0 or later.

Package	Affected versions	Patched versions
org.exist-db:exist-core Maven	`< 5.1.0`	`5.1.0`
exist exist-db	`= 5.0.0< 5.0.0`	`5.0.0`

Description

exist version <= 5.0.0-RC4 contains a XML External Entity (XXE) vulnerability in XML Parser for REST Server that can result in Disclosure of confidential data, denial of service, SSRF, port scanning.

NVD description

exist version <= 5.0.0-RC4 contains a XML External Entity (XXE) vulnerability in XML Parser for REST Server that can result in Disclosure of confidential data, denial of service, SSRF, port scanning.

References

nvd.nist.gov/vuln/detail/CVE-2018-1000823 · ADVISORY
eXist-db/exist · WEB
eXist-db/exist#2243 · WEB
eXist-db/exist#2247 · WEB
eXist-db/exist commit 1c3f0ae · WEB
eXist-db/exist commit b210f9f · WEB
0dd.zone/2018/10/27/exist-XXE · WEB
GitHub Advisory GHSA-jxm5-5xcw-h57q · ADVISORY
eXist-db/exist · PACKAGE
0dd.zone/2018/10/27/exist-XXE · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free