CVE-2018-1000889 is an XML External Entity (XXE) vulnerability affecting Logisim Evolution versions 2.14.3 and earlier. This flaw, located in the circuit file loading functionality, allows for information leakage and potentially remote code execution if a user opens a specially crafted circuit file. With a CVSS score of 8.8 (High), it presents a significant risk due to its network-based attack vector and low attack complexity. While there is no evidence of active exploitation or publicly available exploit code, the vulnerability has garnered some community discussion, and a fix was released in version 2.14.4.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 2.14.3CPE matchmatch criteria | cpe:2.3:a:logisim-evolution_project:logisim-evolution:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.