FrostWire version <= frostwire-desktop-6.7.4-build-272 contains a XML External Entity (XXE) vulnerability in Man in the middle on update that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via Man in the middle the call to update the software.
Weakness
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Frostwire | Frostwire | 1.9.9-build246 (including) | 1.9.9-build246 (including) |
| Frostwire | Frostwire | 1.9.9-build247 (including) | 1.9.9-build247 (including) |
| Frostwire | Frostwire | 2.0.7-build263 (including) | 2.0.7-build263 (including) |
| Frostwire | Frostwire | 6.1.6-build166 (including) | 6.1.6-build166 (including) |
| Frostwire | Frostwire | 6.1.6-build167 (including) | 6.1.6-build167 (including) |
| Frostwire | Frostwire | 6.1.7-build168 (including) | 6.1.7-build168 (including) |
| Frostwire | Frostwire | 6.1.8-build169 (including) | 6.1.8-build169 (including) |
| Frostwire | Frostwire | 6.1.9-build172 (including) | 6.1.9-build172 (including) |
| Frostwire | Frostwire | 6.2.0-build173 (including) | 6.2.0-build173 (including) |
| Frostwire | Frostwire | 6.2.0-build174 (including) | 6.2.0-build174 (including) |
| Frostwire | Frostwire | 6.2.1-build175 (including) | 6.2.1-build175 (including) |
| Frostwire | Frostwire | 6.2.2-build176 (including) | 6.2.2-build176 (including) |
| Frostwire | Frostwire | 6.2.3-build177 (including) | 6.2.3-build177 (including) |
| Frostwire | Frostwire | 6.2.3-build178 (including) | 6.2.3-build178 (including) |
| Frostwire | Frostwire | 6.2.4-build179 (including) | 6.2.4-build179 (including) |
| Frostwire | Frostwire | 6.3.0-build180 (including) | 6.3.0-build180 (including) |
| Frostwire | Frostwire | 6.3.0-build181 (including) | 6.3.0-build181 (including) |
| Frostwire | Frostwire | 6.3.0-build182 (including) | 6.3.0-build182 (including) |
| Frostwire | Frostwire | 6.3.0-build183 (including) | 6.3.0-build183 (including) |
| Frostwire | Frostwire | 6.3.0-build184 (including) | 6.3.0-build184 (including) |
| Frostwire | Frostwire | 6.3.0-build185 (including) | 6.3.0-build185 (including) |
| Frostwire | Frostwire | 6.3.1-build186 (including) | 6.3.1-build186 (including) |
| Frostwire | Frostwire | 6.3.2-build187 (including) | 6.3.2-build187 (including) |
| Frostwire | Frostwire | 6.3.2-build188 (including) | 6.3.2-build188 (including) |
| Frostwire | Frostwire | 6.3.3-build189 (including) | 6.3.3-build189 (including) |
| Frostwire | Frostwire | 6.3.3-build190 (including) | 6.3.3-build190 (including) |
| Frostwire | Frostwire | 6.3.3-build193 (including) | 6.3.3-build193 (including) |
| Frostwire | Frostwire | 6.3.3-build255 (including) | 6.3.3-build255 (including) |
| Frostwire | Frostwire | 6.3.4-build193 (including) | 6.3.4-build193 (including) |
| Frostwire | Frostwire | 6.3.4-build194 (including) | 6.3.4-build194 (including) |
| Frostwire | Frostwire | 6.3.5-build195 (including) | 6.3.5-build195 (including) |
| Frostwire | Frostwire | 6.3.5-build197 (including) | 6.3.5-build197 (including) |
| Frostwire | Frostwire | 6.3.5-build198 (including) | 6.3.5-build198 (including) |
| Frostwire | Frostwire | 6.3.6-build201 (including) | 6.3.6-build201 (including) |
| Frostwire | Frostwire | 6.3.6-build202 (including) | 6.3.6-build202 (including) |
| Frostwire | Frostwire | 6.3.7-build203 (including) | 6.3.7-build203 (including) |
| Frostwire | Frostwire | 6.3.7-build204 (including) | 6.3.7-build204 (including) |
| Frostwire | Frostwire | 6.3.7-build205 (including) | 6.3.7-build205 (including) |
| Frostwire | Frostwire | 6.3.7-build206 (including) | 6.3.7-build206 (including) |
| Frostwire | Frostwire | 6.4.0-build207 (including) | 6.4.0-build207 (including) |
| Frostwire | Frostwire | 6.4.0-build208 (including) | 6.4.0-build208 (including) |
| Frostwire | Frostwire | 6.4.1-build209 (including) | 6.4.1-build209 (including) |
| Frostwire | Frostwire | 6.4.1-build210 (including) | 6.4.1-build210 (including) |
| Frostwire | Frostwire | 6.4.2-build212 (including) | 6.4.2-build212 (including) |
| Frostwire | Frostwire | 6.4.3-build214 (including) | 6.4.3-build214 (including) |
| Frostwire | Frostwire | 6.4.4-build215 (including) | 6.4.4-build215 (including) |
| Frostwire | Frostwire | 6.4.5-build218 (including) | 6.4.5-build218 (including) |
| Frostwire | Frostwire | 6.4.5-build219 (including) | 6.4.5-build219 (including) |
| Frostwire | Frostwire | 6.4.5-build220 (including) | 6.4.5-build220 (including) |
| Frostwire | Frostwire | 6.4.5-build221 (including) | 6.4.5-build221 (including) |
| Frostwire | Frostwire | 6.4.5-build222 (including) | 6.4.5-build222 (including) |
| Frostwire | Frostwire | 6.4.6-build223 (including) | 6.4.6-build223 (including) |
| Frostwire | Frostwire | 6.4.6-build227 (including) | 6.4.6-build227 (including) |
| Frostwire | Frostwire | 6.4.7-build228 (including) | 6.4.7-build228 (including) |
| Frostwire | Frostwire | 6.4.7-build229 (including) | 6.4.7-build229 (including) |
| Frostwire | Frostwire | 6.4.8-build230 (including) | 6.4.8-build230 (including) |
| Frostwire | Frostwire | 6.4.8-build232 (including) | 6.4.8-build232 (including) |
| Frostwire | Frostwire | 6.4.8-build233 (including) | 6.4.8-build233 (including) |
| Frostwire | Frostwire | 6.4.8-build234 (including) | 6.4.8-build234 (including) |
| Frostwire | Frostwire | 6.4.9-build235 (including) | 6.4.9-build235 (including) |
| Frostwire | Frostwire | 6.5.0-build236 (including) | 6.5.0-build236 (including) |
| Frostwire | Frostwire | 6.5.1-build238 (including) | 6.5.1-build238 (including) |
| Frostwire | Frostwire | 6.5.2-build239 (including) | 6.5.2-build239 (including) |
| Frostwire | Frostwire | 6.5.3-build240 (including) | 6.5.3-build240 (including) |
| Frostwire | Frostwire | 6.5.4-build241 (including) | 6.5.4-build241 (including) |
| Frostwire | Frostwire | 6.5.5-build242 (including) | 6.5.5-build242 (including) |
| Frostwire | Frostwire | 6.5.5-build243 (including) | 6.5.5-build243 (including) |
| Frostwire | Frostwire | 6.5.8-build244 (including) | 6.5.8-build244 (including) |
| Frostwire | Frostwire | 6.5.8-build245 (including) | 6.5.8-build245 (including) |
| Frostwire | Frostwire | 6.5.9-build246 (including) | 6.5.9-build246 (including) |
| Frostwire | Frostwire | 6.6.0-build248 (including) | 6.6.0-build248 (including) |
| Frostwire | Frostwire | 6.6.1-build249 (including) | 6.6.1-build249 (including) |
| Frostwire | Frostwire | 6.6.2-build250 (including) | 6.6.2-build250 (including) |
| Frostwire | Frostwire | 6.6.2-build251 (including) | 6.6.2-build251 (including) |
| Frostwire | Frostwire | 6.6.3-build252 (including) | 6.6.3-build252 (including) |
| Frostwire | Frostwire | 6.6.3-build253 (including) | 6.6.3-build253 (including) |
| Frostwire | Frostwire | 6.6.4-build256 (including) | 6.6.4-build256 (including) |
| Frostwire | Frostwire | 6.6.5-build257 (including) | 6.6.5-build257 (including) |
| Frostwire | Frostwire | 6.6.6-build258 (including) | 6.6.6-build258 (including) |
| Frostwire | Frostwire | 6.6.7-build529 (including) | 6.6.7-build529 (including) |
| Frostwire | Frostwire | 6.6.8-build260 (including) | 6.6.8-build260 (including) |
| Frostwire | Frostwire | 6.7.0-build261 (including) | 6.7.0-build261 (including) |
| Frostwire | Frostwire | 6.7.0-build262 (including) | 6.7.0-build262 (including) |
| Frostwire | Frostwire | 6.7.0-build264 (including) | 6.7.0-build264 (including) |
| Frostwire | Frostwire | 6.7.0-build265hotfix (including) | 6.7.0-build265hotfix (including) |
| Frostwire | Frostwire | 6.7.1-build266 (including) | 6.7.1-build266 (including) |
| Frostwire | Frostwire | 6.7.1-build267 (including) | 6.7.1-build267 (including) |
| Frostwire | Frostwire | 6.7.1-build268 (including) | 6.7.1-build268 (including) |
| Frostwire | Frostwire | 6.7.2-build269 (including) | 6.7.2-build269 (including) |
| Frostwire | Frostwire | 6.7.2-build270 (including) | 6.7.2-build270 (including) |
| Frostwire | Frostwire | 6.7.3-build271 (including) | 6.7.3-build271 (including) |
| Frostwire | Frostwire | 6.7.4-build272 (including) | 6.7.4-build272 (including) |