Vulnerability Report

CVE-2018-1000844

Title: Squareup Retrofit XML External Entity (XXE)

XML External Entity (XXE)

Proof Of Concept

PoC Available for CVE-2018-1000844

CWE Category CWE-611

Published Date Dec 20, 2018

Modified Date Nov 21, 2024

Exploit Status Available

Score 9.1 CVSS v3.0

Exploit Probability (EPSS)

2.15%

Vulnerability Summary

CVE-2018-1000844: Square Open Source Retrofit version Prior to commit 4a693c5aeeef2be6c7ecf80e7b5ec79f6ab59437 contains a XML External Entity (XXE) vulnerability in JAXB that can result in An attacker could use this to remotely read files from the file system or to perform SSRF.. This vulnerability appears to have been fixed in After commit 4a693c5aeeef2be6c7ecf80e7b5ec79f6ab59437.

Impacted Vendors

squareup 1

Reference Links

https://github.com/square/retrofit/pull/2735 https://github.com/square/retrofit/pull/2735

CVSS v3.0

Source Entity [email protected]

Severity CRITICAL

9.1

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CVSS v2.0

Source Entity [email protected]

Severity MEDIUM

6.4

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:N/AC:L/Au:N/C:P/I:P/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2018-1000844 Exploits & PoCs (Proof Of Concept)

GitHub https://github.com/epicosy/Retrofit-1

View Code

November 21, 2024 MODIFIED

Vulnerability data or affected products updated.

December 20, 2018 PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector NETWORK

Complexity LOW

Privileges N/A

Interaction NONE

CVSS Vector String


                                    CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected Stack

No specific products linked.