Vulnerability Description
Logisim Evolution version 2.14.3 and earlier contains an XML External Entity (XXE) vulnerability in Circuit file loading functionality (loadXmlFrom in src/com/cburch/logisim/file/XmlReader.java) that can result in information leak, possible RCE depending on system configuration. This attack appears to be exploitable via the victim opening a specially crafted circuit file. This vulnerability appears to have been fixed in 2.14.4.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Logisim-Evolution Project | Logisim-Evolution | <= 2.14.3 |
Related Weaknesses (CWE)
References
- https://github.com/reds-heig/logisim-evolution/pull/139PatchThird Party Advisory
- https://www.kvakil.me/posts/logisim/Third Party Advisory
- https://github.com/reds-heig/logisim-evolution/pull/139PatchThird Party Advisory
- https://www.kvakil.me/posts/logisim/Third Party Advisory
FAQ
What is CVE-2018-1000889?
CVE-2018-1000889 is a vulnerability with a CVSS score of 8.8 (HIGH). Logisim Evolution version 2.14.3 and earlier contains an XML External Entity (XXE) vulnerability in Circuit file loading functionality (loadXmlFrom in src/com/cburch/logisim/file/XmlReader.java) that ...
How severe is CVE-2018-1000889?
CVE-2018-1000889 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-1000889?
Check the references section above for vendor advisories and patch information. Affected products include: Logisim-Evolution Project Logisim-Evolution.