CVE-2018-1000828

2022-10-0316:21:59

mitre

www.cve.org

frostwire

xml external entity (xxe)

data disclosure

denial of service

ssrf

port scanning

man in the middle

9 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

52.9%

JSON

FrostWire version <= frostwire-desktop-6.7.4-build-272 contains a XML External Entity (XXE) vulnerability in Man in the middle on update that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via Man in the middle the call to update the software.