CVE-2018-1000837 describes a critical XML External Entity (XXE) vulnerability in UML Designer versions up to 8.0.0. This flaw allows attackers to exploit a malicious plugins.xml file, leading to severe impacts like data disclosure, denial of service, Server-Side Request Forgery (SSRF), and port scanning. With a CVSS score of 10.0, this vulnerability is easily exploitable over the network without user interaction, posing a significant risk. While no active exploitation or public exploit code is currently known, and community discussion is minimal, its critical severity warrants immediate attention for affected organizations.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 8.0.0CPE matchmatch criteria | cpe:2.3:a:obeo:uml_designer:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.