CRITICAL🇵🇱 Wersja polska

CVE-2018-1000838

CVSS 10.0v3.0pub. 2018-12-20upd. 2024-11-21

autopsy version <= 4.9.0 contains a XML External Entity (XXE) vulnerability in CaseMetadata XML Parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via Specially crafted CaseMetadata.

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

  • Sleuthkit Autopsy

    APP
    Sleuthkit
    ≤ 4.9.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
SSRFDoSXXE
CWE
References

Related vulnerabilities

CVE-2020-10232CRITICAL9.8PL ✓same vendor

Stack buffer overflow w The Sleuth Kit – parsowanie znaczników czasu YAFFS

CVE-2020-10233CRITICAL9.1PL ✓same vendor

Heap-based buffer over-read w The Sleuth Kit przy analizie NTFS

CVE-2019-14531CRITICAL9.8PL ✓same vendor

Out-of-bounds read w The Sleuth Kit przy parsowaniu obrazów ISO 9660

CVE-2019-14532CRITICAL9.8PL ✓same vendor

Off-by-one overwrite w The Sleuth Kit (TSK) — błędna tablica skrótów

CVE-2026-40024HIGH8.4same vendor

The Sleuth Kit through 4.14.0 contains a path traversal vulnerability in tsk_recover that allows an attacker t...