CVE-2018-1000652

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2018-1000652
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1000652.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2018-1000652
Downstream
Published
2018-08-20T19:31:44.230Z
Modified
2026-04-10T04:06:42.816044Z
Severity
  • 10.0 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

JabRef version <=4.3.1 contains a XML External Entity (XXE) vulnerability in MsBibImporter XML Parser that can result in disclosure of confidential data, denial of service, server side request forgery, port scanning. This attack appear to be exploitable via Specially crafted MsBib file. This vulnerability appears to have been fixed in after commit 89f855d.

References

Affected packages

Git / github.com/jabref/jabref

Affected ranges

Type
GIT
Repo
https://github.com/jabref/jabref
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
389555e4a095257d1c21719bfb261b7cf2622fef
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "4.3.1"
        }
    ]
}

Affected versions

v3.*
v3.0
v3.1
v3.2
v3.3
v3.4
v3.5
v4.*
v4.0
v4.0-beta
v4.0-beta2
v4.0-beta3
v4.1
v4.2
v4.3
v4.3.1
v_2.*
v_2.10
v_2.10b2
v_2.10b3
v_2.11b
v_2.11b2
v_2.11b3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1000652.json"