CVE-2018-1000828

2018-12-2015:29:01

Google

osv.dev

6.9 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

52.9%

JSON

FrostWire version <= frostwire-desktop-6.7.4-build-272 contains a XML External Entity (XXE) vulnerability in Man in the middle on update that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via Man in the middle the call to update the software.

CPENameOperatorVersion
frostwireeqfrostwire-android-1.8.5-build-327
frostwireeqfrostwire-desktop-6.3.0-build-183
frostwireeqfrostwire-android-1.7.5-build-260
frostwireeqfrostwire-desktop-6.5.5-build-243
frostwireeqfrostwire-android-1.6.8-build-227
frostwireeqfrostwire-android-1.9.9-build-432
frostwireeqfrostwire-android-1.9.9-build-451
frostwireeqfrostwire-desktop-6.2.0-build-173
frostwireeqfrostwire-desktop-6.3.3-build-193
frostwireeqfrostwire-android-1.9.9-build-433

Name	Operator	Version
frostwire	eq	frostwire-android-1.8.5-build-327
frostwire	eq	frostwire-desktop-6.3.0-build-183
frostwire	eq	frostwire-android-1.7.5-build-260
frostwire	eq	frostwire-desktop-6.5.5-build-243
frostwire	eq	frostwire-android-1.6.8-build-227
frostwire	eq	frostwire-android-1.9.9-build-432
frostwire	eq	frostwire-android-1.9.9-build-451
frostwire	eq	frostwire-desktop-6.2.0-build-173
frostwire	eq	frostwire-desktop-6.3.3-build-193
frostwire	eq	frostwire-android-1.9.9-build-433