exist-db:exist-core XML External Entity (XXE) vulnerability

KRITISCH 10.0CVE-2018-1000823 · GHSA-jxm5-5xcw-h57q · Published 20/12/2018 · updated 17/06/2026

Kurz gesagt

CVE-2018-1000823 ist eine Schwachstelle (KRITISCH (CVSS 10.0)) in org.exist-db:exist-core, exist (exist-db).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.9%, höher als bei 79.6% aller Schwachstellen.
Abhilfe: auf 5.1.0, 5.0.0 oder neuer aktualisieren.

Package	Affected versions	Patched versions
org.exist-db:exist-core Maven	`< 5.1.0`	`5.1.0`
exist exist-db	`= 5.0.0< 5.0.0`	`5.0.0`

Description

exist version <= 5.0.0-RC4 contains a XML External Entity (XXE) vulnerability in XML Parser for REST Server that can result in Disclosure of confidential data, denial of service, SSRF, port scanning.

NVD description

exist version <= 5.0.0-RC4 contains a XML External Entity (XXE) vulnerability in XML Parser for REST Server that can result in Disclosure of confidential data, denial of service, SSRF, port scanning.

References

nvd.nist.gov/vuln/detail/CVE-2018-1000823 · ADVISORY
eXist-db/exist · WEB
eXist-db/exist#2243 · WEB
eXist-db/exist#2247 · WEB
eXist-db/exist commit 1c3f0ae · WEB
eXist-db/exist commit b210f9f · WEB
0dd.zone/2018/10/27/exist-XXE · WEB
GitHub Advisory GHSA-jxm5-5xcw-h57q · ADVISORY
eXist-db/exist · PACKAGE
0dd.zone/2018/10/27/exist-XXE · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free