CVE Vulnerabilities

CVE-2018-1000828

Improper Restriction of XML External Entity Reference

Published: Dec 20, 2018 | Modified: Nov 21, 2024
CVSS 3.x
9
CRITICAL
Source:
NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS 2.x
6.8 MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P
RedHat/V2
RedHat/V3
Ubuntu

FrostWire version <= frostwire-desktop-6.7.4-build-272 contains a XML External Entity (XXE) vulnerability in Man in the middle on update that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via Man in the middle the call to update the software.

Weakness

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Affected Software

Name Vendor Start Version End Version
Frostwire Frostwire 1.9.9-build246 (including) 1.9.9-build246 (including)
Frostwire Frostwire 1.9.9-build247 (including) 1.9.9-build247 (including)
Frostwire Frostwire 2.0.7-build263 (including) 2.0.7-build263 (including)
Frostwire Frostwire 6.1.6-build166 (including) 6.1.6-build166 (including)
Frostwire Frostwire 6.1.6-build167 (including) 6.1.6-build167 (including)
Frostwire Frostwire 6.1.7-build168 (including) 6.1.7-build168 (including)
Frostwire Frostwire 6.1.8-build169 (including) 6.1.8-build169 (including)
Frostwire Frostwire 6.1.9-build172 (including) 6.1.9-build172 (including)
Frostwire Frostwire 6.2.0-build173 (including) 6.2.0-build173 (including)
Frostwire Frostwire 6.2.0-build174 (including) 6.2.0-build174 (including)
Frostwire Frostwire 6.2.1-build175 (including) 6.2.1-build175 (including)
Frostwire Frostwire 6.2.2-build176 (including) 6.2.2-build176 (including)
Frostwire Frostwire 6.2.3-build177 (including) 6.2.3-build177 (including)
Frostwire Frostwire 6.2.3-build178 (including) 6.2.3-build178 (including)
Frostwire Frostwire 6.2.4-build179 (including) 6.2.4-build179 (including)
Frostwire Frostwire 6.3.0-build180 (including) 6.3.0-build180 (including)
Frostwire Frostwire 6.3.0-build181 (including) 6.3.0-build181 (including)
Frostwire Frostwire 6.3.0-build182 (including) 6.3.0-build182 (including)
Frostwire Frostwire 6.3.0-build183 (including) 6.3.0-build183 (including)
Frostwire Frostwire 6.3.0-build184 (including) 6.3.0-build184 (including)
Frostwire Frostwire 6.3.0-build185 (including) 6.3.0-build185 (including)
Frostwire Frostwire 6.3.1-build186 (including) 6.3.1-build186 (including)
Frostwire Frostwire 6.3.2-build187 (including) 6.3.2-build187 (including)
Frostwire Frostwire 6.3.2-build188 (including) 6.3.2-build188 (including)
Frostwire Frostwire 6.3.3-build189 (including) 6.3.3-build189 (including)
Frostwire Frostwire 6.3.3-build190 (including) 6.3.3-build190 (including)
Frostwire Frostwire 6.3.3-build193 (including) 6.3.3-build193 (including)
Frostwire Frostwire 6.3.3-build255 (including) 6.3.3-build255 (including)
Frostwire Frostwire 6.3.4-build193 (including) 6.3.4-build193 (including)
Frostwire Frostwire 6.3.4-build194 (including) 6.3.4-build194 (including)
Frostwire Frostwire 6.3.5-build195 (including) 6.3.5-build195 (including)
Frostwire Frostwire 6.3.5-build197 (including) 6.3.5-build197 (including)
Frostwire Frostwire 6.3.5-build198 (including) 6.3.5-build198 (including)
Frostwire Frostwire 6.3.6-build201 (including) 6.3.6-build201 (including)
Frostwire Frostwire 6.3.6-build202 (including) 6.3.6-build202 (including)
Frostwire Frostwire 6.3.7-build203 (including) 6.3.7-build203 (including)
Frostwire Frostwire 6.3.7-build204 (including) 6.3.7-build204 (including)
Frostwire Frostwire 6.3.7-build205 (including) 6.3.7-build205 (including)
Frostwire Frostwire 6.3.7-build206 (including) 6.3.7-build206 (including)
Frostwire Frostwire 6.4.0-build207 (including) 6.4.0-build207 (including)
Frostwire Frostwire 6.4.0-build208 (including) 6.4.0-build208 (including)
Frostwire Frostwire 6.4.1-build209 (including) 6.4.1-build209 (including)
Frostwire Frostwire 6.4.1-build210 (including) 6.4.1-build210 (including)
Frostwire Frostwire 6.4.2-build212 (including) 6.4.2-build212 (including)
Frostwire Frostwire 6.4.3-build214 (including) 6.4.3-build214 (including)
Frostwire Frostwire 6.4.4-build215 (including) 6.4.4-build215 (including)
Frostwire Frostwire 6.4.5-build218 (including) 6.4.5-build218 (including)
Frostwire Frostwire 6.4.5-build219 (including) 6.4.5-build219 (including)
Frostwire Frostwire 6.4.5-build220 (including) 6.4.5-build220 (including)
Frostwire Frostwire 6.4.5-build221 (including) 6.4.5-build221 (including)
Frostwire Frostwire 6.4.5-build222 (including) 6.4.5-build222 (including)
Frostwire Frostwire 6.4.6-build223 (including) 6.4.6-build223 (including)
Frostwire Frostwire 6.4.6-build227 (including) 6.4.6-build227 (including)
Frostwire Frostwire 6.4.7-build228 (including) 6.4.7-build228 (including)
Frostwire Frostwire 6.4.7-build229 (including) 6.4.7-build229 (including)
Frostwire Frostwire 6.4.8-build230 (including) 6.4.8-build230 (including)
Frostwire Frostwire 6.4.8-build232 (including) 6.4.8-build232 (including)
Frostwire Frostwire 6.4.8-build233 (including) 6.4.8-build233 (including)
Frostwire Frostwire 6.4.8-build234 (including) 6.4.8-build234 (including)
Frostwire Frostwire 6.4.9-build235 (including) 6.4.9-build235 (including)
Frostwire Frostwire 6.5.0-build236 (including) 6.5.0-build236 (including)
Frostwire Frostwire 6.5.1-build238 (including) 6.5.1-build238 (including)
Frostwire Frostwire 6.5.2-build239 (including) 6.5.2-build239 (including)
Frostwire Frostwire 6.5.3-build240 (including) 6.5.3-build240 (including)
Frostwire Frostwire 6.5.4-build241 (including) 6.5.4-build241 (including)
Frostwire Frostwire 6.5.5-build242 (including) 6.5.5-build242 (including)
Frostwire Frostwire 6.5.5-build243 (including) 6.5.5-build243 (including)
Frostwire Frostwire 6.5.8-build244 (including) 6.5.8-build244 (including)
Frostwire Frostwire 6.5.8-build245 (including) 6.5.8-build245 (including)
Frostwire Frostwire 6.5.9-build246 (including) 6.5.9-build246 (including)
Frostwire Frostwire 6.6.0-build248 (including) 6.6.0-build248 (including)
Frostwire Frostwire 6.6.1-build249 (including) 6.6.1-build249 (including)
Frostwire Frostwire 6.6.2-build250 (including) 6.6.2-build250 (including)
Frostwire Frostwire 6.6.2-build251 (including) 6.6.2-build251 (including)
Frostwire Frostwire 6.6.3-build252 (including) 6.6.3-build252 (including)
Frostwire Frostwire 6.6.3-build253 (including) 6.6.3-build253 (including)
Frostwire Frostwire 6.6.4-build256 (including) 6.6.4-build256 (including)
Frostwire Frostwire 6.6.5-build257 (including) 6.6.5-build257 (including)
Frostwire Frostwire 6.6.6-build258 (including) 6.6.6-build258 (including)
Frostwire Frostwire 6.6.7-build529 (including) 6.6.7-build529 (including)
Frostwire Frostwire 6.6.8-build260 (including) 6.6.8-build260 (including)
Frostwire Frostwire 6.7.0-build261 (including) 6.7.0-build261 (including)
Frostwire Frostwire 6.7.0-build262 (including) 6.7.0-build262 (including)
Frostwire Frostwire 6.7.0-build264 (including) 6.7.0-build264 (including)
Frostwire Frostwire 6.7.0-build265hotfix (including) 6.7.0-build265hotfix (including)
Frostwire Frostwire 6.7.1-build266 (including) 6.7.1-build266 (including)
Frostwire Frostwire 6.7.1-build267 (including) 6.7.1-build267 (including)
Frostwire Frostwire 6.7.1-build268 (including) 6.7.1-build268 (including)
Frostwire Frostwire 6.7.2-build269 (including) 6.7.2-build269 (including)
Frostwire Frostwire 6.7.2-build270 (including) 6.7.2-build270 (including)
Frostwire Frostwire 6.7.3-build271 (including) 6.7.3-build271 (including)
Frostwire Frostwire 6.7.4-build272 (including) 6.7.4-build272 (including)

Potential Mitigations

References