CVE-2018-1000838

CRITICAL

autopsy version <= 4.9.0 contains a XML External Entity (XXE) vulnerability in CaseMetadata XML Parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via Specially crafted CaseMetadata.

Published: Dec 20, 2018 Modified: Jun 17, 2026

CWE-611

CVSS Metrics

CVSSv3

Attack Vector: NETWORK Attack Complexity: LOW Privileges Required: NONE User Interaction: NONE Scope: CHANGED Confidentiality Impact: HIGH Integrity Impact: HIGH Availability Impact: HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected Products (1)

Vendor	Product	Version
sleuthkit	autopsy	*

GitHub Security Advisory GHSA-4v52-8764-fm33

autopsy version <= 4.9.0 contains a XML External Entity (XXE) vulnerability in CaseMetadata XML...

References (4)

https://0dd.zone/2018/10/28/autopsy-XXE/ Third Party Advisory
https://github.com/sleuthkit/autopsy/issues/4236 Issue Tracking, Third Party Advisory
https://0dd.zone/2018/10/28/autopsy-XXE/ Third Party Advisory
https://github.com/sleuthkit/autopsy/issues/4236 Issue Tracking, Third Party Advisory

Risk Scores

CVSS Score 10.0 / 10

EPSS Score 2.50%

Top 17% most likely to be exploited

Threat Score 40.8 / 100

Data Sources

NVD EPSS GitHub