CVE-2018-1000828
Summary
| CVE | CVE-2018-1000828 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2018-12-20 15:29:00 UTC |
| Updated | 2019-10-24 12:31:00 UTC |
| Description | FrostWire version <= frostwire-desktop-6.7.4-build-272 contains a XML External Entity (XXE) vulnerability in Man in the middle on update that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via Man in the middle the call to update the software. |
Risk And Classification
Problem Types: CWE-611
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Frostwire | Frostwire | 1.9.9 | build246 | All | All |
| Application | Frostwire | Frostwire | 1.9.9 | build247 | All | All |
| Application | Frostwire | Frostwire | 2.0.7 | build263 | All | All |
| Application | Frostwire | Frostwire | 6.1.6 | build166 | All | All |
| Application | Frostwire | Frostwire | 6.1.6 | build167 | All | All |
| Application | Frostwire | Frostwire | 6.1.7 | build168 | All | All |
| Application | Frostwire | Frostwire | 6.1.8 | build169 | All | All |
| Application | Frostwire | Frostwire | 6.1.9 | build172 | All | All |
| Application | Frostwire | Frostwire | 6.2.0 | build173 | All | All |
| Application | Frostwire | Frostwire | 6.2.0 | build174 | All | All |
| Application | Frostwire | Frostwire | 6.2.1 | build175 | All | All |
| Application | Frostwire | Frostwire | 6.2.2 | build176 | All | All |
| Application | Frostwire | Frostwire | 6.2.3 | build177 | All | All |
| Application | Frostwire | Frostwire | 6.2.3 | build178 | All | All |
| Application | Frostwire | Frostwire | 6.2.4 | build179 | All | All |
| Application | Frostwire | Frostwire | 6.3.0 | build180 | All | All |
| Application | Frostwire | Frostwire | 6.3.0 | build181 | All | All |
| Application | Frostwire | Frostwire | 6.3.0 | build182 | All | All |
| Application | Frostwire | Frostwire | 6.3.0 | build183 | All | All |
| Application | Frostwire | Frostwire | 6.3.0 | build184 | All | All |
| Application | Frostwire | Frostwire | 6.3.0 | build185 | All | All |
| Application | Frostwire | Frostwire | 6.3.1 | build186 | All | All |
| Application | Frostwire | Frostwire | 6.3.2 | build187 | All | All |
| Application | Frostwire | Frostwire | 6.3.2 | build188 | All | All |
| Application | Frostwire | Frostwire | 6.3.3 | build189 | All | All |
| Application | Frostwire | Frostwire | 6.3.3 | build190 | All | All |
| Application | Frostwire | Frostwire | 6.3.3 | build193 | All | All |
| Application | Frostwire | Frostwire | 6.3.3 | build255 | All | All |
| Application | Frostwire | Frostwire | 6.3.4 | build193 | All | All |
| Application | Frostwire | Frostwire | 6.3.4 | build194 | All | All |
| Application | Frostwire | Frostwire | 6.3.5 | build195 | All | All |
| Application | Frostwire | Frostwire | 6.3.5 | build197 | All | All |
| Application | Frostwire | Frostwire | 6.3.5 | build198 | All | All |
| Application | Frostwire | Frostwire | 6.3.6 | build201 | All | All |
| Application | Frostwire | Frostwire | 6.3.6 | build202 | All | All |
| Application | Frostwire | Frostwire | 6.3.7 | build203 | All | All |
| Application | Frostwire | Frostwire | 6.3.7 | build204 | All | All |
| Application | Frostwire | Frostwire | 6.3.7 | build205 | All | All |
| Application | Frostwire | Frostwire | 6.3.7 | build206 | All | All |
| Application | Frostwire | Frostwire | 6.4.0 | build207 | All | All |
| Application | Frostwire | Frostwire | 6.4.0 | build208 | All | All |
| Application | Frostwire | Frostwire | 6.4.1 | build209 | All | All |
| Application | Frostwire | Frostwire | 6.4.1 | build210 | All | All |
| Application | Frostwire | Frostwire | 6.4.2 | build212 | All | All |
| Application | Frostwire | Frostwire | 6.4.3 | build214 | All | All |
| Application | Frostwire | Frostwire | 6.4.4 | build215 | All | All |
| Application | Frostwire | Frostwire | 6.4.5 | build218 | All | All |
| Application | Frostwire | Frostwire | 6.4.5 | build219 | All | All |
| Application | Frostwire | Frostwire | 6.4.5 | build220 | All | All |
| Application | Frostwire | Frostwire | 6.4.5 | build221 | All | All |
| Application | Frostwire | Frostwire | 6.4.5 | build222 | All | All |
| Application | Frostwire | Frostwire | 6.4.6 | build223 | All | All |
| Application | Frostwire | Frostwire | 6.4.6 | build227 | All | All |
| Application | Frostwire | Frostwire | 6.4.7 | build228 | All | All |
| Application | Frostwire | Frostwire | 6.4.7 | build229 | All | All |
| Application | Frostwire | Frostwire | 6.4.8 | build230 | All | All |
| Application | Frostwire | Frostwire | 6.4.8 | build232 | All | All |
| Application | Frostwire | Frostwire | 6.4.8 | build233 | All | All |
| Application | Frostwire | Frostwire | 6.4.8 | build234 | All | All |
| Application | Frostwire | Frostwire | 6.4.9 | build235 | All | All |
| Application | Frostwire | Frostwire | 6.5.0 | build236 | All | All |
| Application | Frostwire | Frostwire | 6.5.1 | build238 | All | All |
| Application | Frostwire | Frostwire | 6.5.2 | build239 | All | All |
| Application | Frostwire | Frostwire | 6.5.3 | build240 | All | All |
| Application | Frostwire | Frostwire | 6.5.4 | build241 | All | All |
| Application | Frostwire | Frostwire | 6.5.5 | build242 | All | All |
| Application | Frostwire | Frostwire | 6.5.5 | build243 | All | All |
| Application | Frostwire | Frostwire | 6.5.8 | build244 | All | All |
| Application | Frostwire | Frostwire | 6.5.8 | build245 | All | All |
| Application | Frostwire | Frostwire | 6.5.9 | build246 | All | All |
| Application | Frostwire | Frostwire | 6.6.0 | build248 | All | All |
| Application | Frostwire | Frostwire | 6.6.1 | build249 | All | All |
| Application | Frostwire | Frostwire | 6.6.2 | build250 | All | All |
| Application | Frostwire | Frostwire | 6.6.2 | build251 | All | All |
| Application | Frostwire | Frostwire | 6.6.3 | build252 | All | All |
| Application | Frostwire | Frostwire | 6.6.3 | build253 | All | All |
| Application | Frostwire | Frostwire | 6.6.4 | build256 | All | All |
| Application | Frostwire | Frostwire | 6.6.5 | build257 | All | All |
| Application | Frostwire | Frostwire | 6.6.6 | build258 | All | All |
| Application | Frostwire | Frostwire | 6.6.7 | build529 | All | All |
| Application | Frostwire | Frostwire | 6.6.8 | build260 | All | All |
| Application | Frostwire | Frostwire | 6.7.0 | build261 | All | All |
| Application | Frostwire | Frostwire | 6.7.0 | build262 | All | All |
| Application | Frostwire | Frostwire | 6.7.0 | build264 | All | All |
| Application | Frostwire | Frostwire | 6.7.0 | build265hotfix | All | All |
| Application | Frostwire | Frostwire | 6.7.1 | build266 | All | All |
| Application | Frostwire | Frostwire | 6.7.1 | build267 | All | All |
| Application | Frostwire | Frostwire | 6.7.1 | build268 | All | All |
| Application | Frostwire | Frostwire | 6.7.2 | build269 | All | All |
| Application | Frostwire | Frostwire | 6.7.2 | build270 | All | All |
| Application | Frostwire | Frostwire | 6.7.3 | build271 | All | All |
| Application | Frostwire | Frostwire | 6.7.4 | build272 | All | All |
| Application | Frostwire | Frostwire | 1.9.9 | build246 | All | All |
| Application | Frostwire | Frostwire | 1.9.9 | build247 | All | All |
| Application | Frostwire | Frostwire | 2.0.7 | build263 | All | All |
| Application | Frostwire | Frostwire | 6.1.6 | build166 | All | All |
| Application | Frostwire | Frostwire | 6.1.6 | build167 | All | All |
| Application | Frostwire | Frostwire | 6.1.7 | build168 | All | All |
| Application | Frostwire | Frostwire | 6.1.8 | build169 | All | All |
| Application | Frostwire | Frostwire | 6.1.9 | build172 | All | All |
| Application | Frostwire | Frostwire | 6.2.0 | build173 | All | All |
| Application | Frostwire | Frostwire | 6.2.0 | build174 | All | All |
| Application | Frostwire | Frostwire | 6.2.1 | build175 | All | All |
| Application | Frostwire | Frostwire | 6.2.2 | build176 | All | All |
| Application | Frostwire | Frostwire | 6.2.3 | build177 | All | All |
| Application | Frostwire | Frostwire | 6.2.3 | build178 | All | All |
| Application | Frostwire | Frostwire | 6.2.4 | build179 | All | All |
| Application | Frostwire | Frostwire | 6.3.0 | build180 | All | All |
| Application | Frostwire | Frostwire | 6.3.0 | build181 | All | All |
| Application | Frostwire | Frostwire | 6.3.0 | build182 | All | All |
| Application | Frostwire | Frostwire | 6.3.0 | build183 | All | All |
| Application | Frostwire | Frostwire | 6.3.0 | build184 | All | All |
| Application | Frostwire | Frostwire | 6.3.0 | build185 | All | All |
| Application | Frostwire | Frostwire | 6.3.1 | build186 | All | All |
| Application | Frostwire | Frostwire | 6.3.2 | build187 | All | All |
| Application | Frostwire | Frostwire | 6.3.2 | build188 | All | All |
| Application | Frostwire | Frostwire | 6.3.3 | build189 | All | All |
| Application | Frostwire | Frostwire | 6.3.3 | build190 | All | All |
| Application | Frostwire | Frostwire | 6.3.3 | build193 | All | All |
| Application | Frostwire | Frostwire | 6.3.3 | build255 | All | All |
| Application | Frostwire | Frostwire | 6.3.4 | build193 | All | All |
| Application | Frostwire | Frostwire | 6.3.4 | build194 | All | All |
| Application | Frostwire | Frostwire | 6.3.5 | build195 | All | All |
| Application | Frostwire | Frostwire | 6.3.5 | build197 | All | All |
| Application | Frostwire | Frostwire | 6.3.5 | build198 | All | All |
| Application | Frostwire | Frostwire | 6.3.6 | build201 | All | All |
| Application | Frostwire | Frostwire | 6.3.6 | build202 | All | All |
| Application | Frostwire | Frostwire | 6.3.7 | build203 | All | All |
| Application | Frostwire | Frostwire | 6.3.7 | build204 | All | All |
| Application | Frostwire | Frostwire | 6.3.7 | build205 | All | All |
| Application | Frostwire | Frostwire | 6.3.7 | build206 | All | All |
| Application | Frostwire | Frostwire | 6.4.0 | build207 | All | All |
| Application | Frostwire | Frostwire | 6.4.0 | build208 | All | All |
| Application | Frostwire | Frostwire | 6.4.1 | build209 | All | All |
| Application | Frostwire | Frostwire | 6.4.1 | build210 | All | All |
| Application | Frostwire | Frostwire | 6.4.2 | build212 | All | All |
| Application | Frostwire | Frostwire | 6.4.3 | build214 | All | All |
| Application | Frostwire | Frostwire | 6.4.4 | build215 | All | All |
| Application | Frostwire | Frostwire | 6.4.5 | build218 | All | All |
| Application | Frostwire | Frostwire | 6.4.5 | build219 | All | All |
| Application | Frostwire | Frostwire | 6.4.5 | build220 | All | All |
| Application | Frostwire | Frostwire | 6.4.5 | build221 | All | All |
| Application | Frostwire | Frostwire | 6.4.5 | build222 | All | All |
| Application | Frostwire | Frostwire | 6.4.6 | build223 | All | All |
| Application | Frostwire | Frostwire | 6.4.6 | build227 | All | All |
| Application | Frostwire | Frostwire | 6.4.7 | build228 | All | All |
| Application | Frostwire | Frostwire | 6.4.7 | build229 | All | All |
| Application | Frostwire | Frostwire | 6.4.8 | build230 | All | All |
| Application | Frostwire | Frostwire | 6.4.8 | build232 | All | All |
| Application | Frostwire | Frostwire | 6.4.8 | build233 | All | All |
| Application | Frostwire | Frostwire | 6.4.8 | build234 | All | All |
| Application | Frostwire | Frostwire | 6.4.9 | build235 | All | All |
| Application | Frostwire | Frostwire | 6.5.0 | build236 | All | All |
| Application | Frostwire | Frostwire | 6.5.1 | build238 | All | All |
| Application | Frostwire | Frostwire | 6.5.2 | build239 | All | All |
| Application | Frostwire | Frostwire | 6.5.3 | build240 | All | All |
| Application | Frostwire | Frostwire | 6.5.4 | build241 | All | All |
| Application | Frostwire | Frostwire | 6.5.5 | build242 | All | All |
| Application | Frostwire | Frostwire | 6.5.5 | build243 | All | All |
| Application | Frostwire | Frostwire | 6.5.8 | build244 | All | All |
| Application | Frostwire | Frostwire | 6.5.8 | build245 | All | All |
| Application | Frostwire | Frostwire | 6.5.9 | build246 | All | All |
| Application | Frostwire | Frostwire | 6.6.0 | build248 | All | All |
| Application | Frostwire | Frostwire | 6.6.1 | build249 | All | All |
| Application | Frostwire | Frostwire | 6.6.2 | build250 | All | All |
| Application | Frostwire | Frostwire | 6.6.2 | build251 | All | All |
| Application | Frostwire | Frostwire | 6.6.3 | build252 | All | All |
| Application | Frostwire | Frostwire | 6.6.3 | build253 | All | All |
| Application | Frostwire | Frostwire | 6.6.4 | build256 | All | All |
| Application | Frostwire | Frostwire | 6.6.5 | build257 | All | All |
| Application | Frostwire | Frostwire | 6.6.6 | build258 | All | All |
| Application | Frostwire | Frostwire | 6.6.7 | build529 | All | All |
| Application | Frostwire | Frostwire | 6.6.8 | build260 | All | All |
| Application | Frostwire | Frostwire | 6.7.0 | build261 | All | All |
| Application | Frostwire | Frostwire | 6.7.0 | build262 | All | All |
| Application | Frostwire | Frostwire | 6.7.0 | build264 | All | All |
| Application | Frostwire | Frostwire | 6.7.0 | build265hotfix | All | All |
| Application | Frostwire | Frostwire | 6.7.1 | build266 | All | All |
| Application | Frostwire | Frostwire | 6.7.1 | build267 | All | All |
| Application | Frostwire | Frostwire | 6.7.1 | build268 | All | All |
| Application | Frostwire | Frostwire | 6.7.2 | build269 | All | All |
| Application | Frostwire | Frostwire | 6.7.2 | build270 | All | All |
| Application | Frostwire | Frostwire | 6.7.3 | build271 | All | All |
| Application | Frostwire | Frostwire | 6.7.4 | build272 | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Frostwire XXE | 0dd - The Zero (0) Day Division | MISC | 0dd.zone | Third Party Advisory |
| XXE in UpdateMessageReader.java via Man-in-the-Middle (MitM) · Issue #829 · frostwire/frostwire · GitHub | MISC | github.com | Issue Tracking, Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.