CVE-2018-1000823: Improper Restriction of XML External Entity Reference

December 20, 2018 (updated September 24, 2019)

exist contains an XML External Entity (XXE) vulnerability in the XML Parser for REST Server that can result in Disclosure of confidential data, denial of service, SSRF, port scanning.

References

github.com/eXist-db/exist/issues/2180
nvd.nist.gov/vuln/detail/CVE-2018-1000823

Detect and mitigate CVE-2018-1000823 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →