CVE-2018-1000825

CRITICAL

FreeCol version <= nightly-2018-08-22 contains a XML External Entity (XXE) vulnerability in FreeColXMLReader parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via Freecol file.

Published: Dec 20, 2018 Modified: Jun 17, 2026

CWE-611

CVSS Metrics

CVSSv3

Attack Vector: NETWORK Attack Complexity: LOW Privileges Required: NONE User Interaction: NONE Scope: CHANGED Confidentiality Impact: HIGH Integrity Impact: HIGH Availability Impact: HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected Products (1)

Vendor	Product	Version
freecol	freecol	*

GitHub Security Advisory GHSA-7g3h-g9h9-3g4r

FreeCol version <= nightly-2018-08-22 contains a XML External Entity (XXE) vulnerability in...

References (4)

https://0dd.zone/2018/10/28/freecol-XXE/ Third Party Advisory
https://github.com/FreeCol/freecol/issues/26 Issue Tracking, Third Party Advisory
https://0dd.zone/2018/10/28/freecol-XXE/ Third Party Advisory
https://github.com/FreeCol/freecol/issues/26 Issue Tracking, Third Party Advisory

Risk Scores

CVSS Score 10.0 / 10

EPSS Score 1.94%

Top 22% most likely to be exploited

Threat Score 40.6 / 100

Data Sources

NVD EPSS GitHub