1. Home
  2. CVE Database
  3. CVE-2018-1000639
CRITICAL · 9.6

CVE-2018-1000639

LatexDraw version <=4.0 contains a XML External Entity (XXE) vulnerability in SVG parsing functionality that can result in disclosure of data, server side request forgery, port scanning, possible rce....

Vulnerability Description

LatexDraw version <=4.0 contains a XML External Entity (XXE) vulnerability in SVG parsing functionality that can result in disclosure of data, server side request forgery, port scanning, possible rce. This attack appear to be exploitable via Specially crafted SVG file.

CVSS Score

9.6

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
Latexdraw ProjectLatexdraw<= 3.3.9

Related Weaknesses (CWE)

CWE-611

References

FAQ

What is CVE-2018-1000639?

CVE-2018-1000639 is a vulnerability with a CVSS score of 9.6 (CRITICAL). LatexDraw version <=4.0 contains a XML External Entity (XXE) vulnerability in SVG parsing functionality that can result in disclosure of data, server side request forgery, port scanning, possible rce....

How severe is CVE-2018-1000639?

CVE-2018-1000639 has been rated CRITICAL with a CVSS base score of 9.6/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2018-1000639?

Check the references section above for vendor advisories and patch information. Affected products include: Latexdraw Project Latexdraw.