CVE-2018-1000651

CRITICAL

Stroom version <5.4.5 contains a XML External Entity (XXE) vulnerability in XML Parser that can result in disclosure of confidential data, denial of service, server side request forgery, port scanning. This attack appear to be exploitable via Specially crafted XML file.

Published: Aug 20, 2018 Modified: Jun 17, 2026

CWE-611

CVSS Metrics

CVSSv3

Attack Vector: NETWORK Attack Complexity: LOW Privileges Required: NONE User Interaction: NONE Scope: CHANGED Confidentiality Impact: HIGH Integrity Impact: HIGH Availability Impact: HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected Products (1)

Vendor	Product	Version
gchq	stroom	* < 5.4.5

GitHub Security Advisory GHSA-7wwr-6qph-hrh6

Stroom version <5.4.5 contains a XML External Entity (XXE) vulnerability in XML Parser that can...

References (4)

https://0dd.zone/2018/08/08/stroom-XXE/ Third Party Advisory
https://github.com/gchq/stroom/issues/813 Issue Tracking, Patch, Third Party Advisory
https://0dd.zone/2018/08/08/stroom-XXE/ Third Party Advisory
https://github.com/gchq/stroom/issues/813 Issue Tracking, Patch, Third Party Advisory

Risk Scores

CVSS Score 10.0 / 10

EPSS Score 1.86%

Top 23% most likely to be exploited

Threat Score 40.6 / 100

Data Sources

NVD EPSS GitHub