CVE-2018-1000821

CRITICAL

MicroMathematics version before commit 5c05ac8 contains a XML External Entity (XXE) vulnerability in SMathStudio files that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via Specially crafted SMathStudio files. This vulnerability appears to have been fixed in after commit 5c05ac8.

Published: Dec 20, 2018 Modified: Jun 17, 2026

CWE-611

CVSS Metrics

CVSSv3

Attack Vector: NETWORK Attack Complexity: LOW Privileges Required: NONE User Interaction: NONE Scope: CHANGED Confidentiality Impact: HIGH Integrity Impact: HIGH Availability Impact: HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected Products (1)

Vendor	Product	Version
micromathematics_project	micromathematics	* < 2.17.3

GitHub Security Advisory GHSA-7q84-r8xm-hp4c

MicroMathematics version before commit 5c05ac8 contains a XML External Entity (XXE) vulnerability...

References (4)

https://0dd.zone/2018/10/27/micromathematics-XXE/ Third Party Advisory
https://github.com/mkulesh/microMathematics/issues/79 Issue Tracking, Third Party Advisory
https://0dd.zone/2018/10/27/micromathematics-XXE/ Third Party Advisory
https://github.com/mkulesh/microMathematics/issues/79 Issue Tracking, Third Party Advisory

Risk Scores

CVSS Score 10.0 / 10

EPSS Score 1.86%

Top 23% most likely to be exploited

Threat Score 40.6 / 100

Data Sources

NVD EPSS GitHub