CVE-2018-1000838

CRITICAL

Autopsy <= 4.9.0 - XML External Entity Injection in CaseMetadata XML Parser

Title source: llm
STIX 2.1

Description

autopsy version <= 4.9.0 contains a XML External Entity (XXE) vulnerability in CaseMetadata XML Parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via Specially crafted CaseMetadata.

References (2)

Core 2
Core References
Issue Tracking, Third Party Advisory x_refsource_misc
https://github.com/sleuthkit/autopsy/issues/4236
Third Party Advisory x_refsource_misc
https://0dd.zone/2018/10/28/autopsy-XXE/

Scores

CVSS v3 10.0
EPSS 0.0250
EPSS Percentile 82.7%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Details

CWE
CWE-611
Status published
Products (1)
sleuthkit/autopsy < 4.9.0
Published Dec 20, 2018
Tracked Since Feb 18, 2026