CVE-2018-1000652

CRITICAL

JabRef version <=4.3.1 contains a XML External Entity (XXE) vulnerability in MsBibImporter XML Parser that can result in disclosure of confidential data, denial of service, server side request forgery, port scanning. This attack appear to be exploitable via Specially crafted MsBib file. This vulnerability appears to have been fixed in after commit 89f855d.

Published: Aug 20, 2018 Modified: Jun 17, 2026

CWE-611

CVSS Metrics

CVSSv3

Attack Vector: NETWORK Attack Complexity: LOW Privileges Required: NONE User Interaction: NONE Scope: CHANGED Confidentiality Impact: HIGH Integrity Impact: HIGH Availability Impact: HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected Products (1)

Vendor	Product	Version
jabref	jabref	*

GitHub Security Advisory GHSA-x4cf-86pp-49rw

JabRef version <=4.3.1 contains a XML External Entity (XXE) vulnerability in MsBibImporter XML...

References (4)

https://0dd.zone/2018/08/08/JabRef-XXE/ Third Party Advisory
https://github.com/JabRef/jabref/issues/4229 Issue Tracking, Third Party Advisory
https://0dd.zone/2018/08/08/JabRef-XXE/ Third Party Advisory
https://github.com/JabRef/jabref/issues/4229 Issue Tracking, Third Party Advisory

Risk Scores

CVSS Score 10.0 / 10

EPSS Score 1.94%

Top 22% most likely to be exploited

Threat Score 40.6 / 100

Data Sources

NVD EPSS GitHub