{"api_version":"1","generated_at":"2026-07-23T13:07:05+00:00","cve":"CVE-2018-1000837","urls":{"html":"https://cve.report/CVE-2018-1000837","api":"https://cve.report/api/cve/CVE-2018-1000837.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2018-1000837","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000837"},"summary":{"title":"CVE-2018-1000837","description":"UML Designer version <= 8.0.0 contains a XML External Entity (XXE) vulnerability in XML parser for plugins that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via malicious plugins.xml file.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2018-12-20 15:29:00","updated_at":"2019-09-11 16:53:00"},"problem_types":["CWE-611"],"metrics":[],"references":[{"url":"https://github.com/ObeoNetwork/UML-Designer/issues/1035","name":"https://github.com/ObeoNetwork/UML-Designer/issues/1035","refsource":"MISC","tags":["Third Party Advisory"],"title":"XXE in ProfileDiagramServices via plugin.xml file · Issue #1035 · ObeoNetwork/UML-Designer · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://0dd.zone/2018/10/28/uml-designer-XXE/","name":"https://0dd.zone/2018/10/28/uml-designer-XXE/","refsource":"MISC","tags":["Issue Tracking","Third Party Advisory"],"title":"UML Designer XXE | 0dd - The Zero (0) Day Division","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1000837","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000837","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2018","cve_id":"1000837","vulnerable":"1","versionEndIncluding":"8.0.0","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"obeo","cpe5":"uml_designer","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","DATE_ASSIGNED":"2018-11-27T13:54:33.473507","DATE_REQUESTED":"2018-10-28T04:29:19","ID":"CVE-2018-1000837","REQUESTER":"sajeeb@0dd.zone","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"UML Designer version <= 8.0.0 contains a XML External Entity (XXE) vulnerability in XML parser for plugins that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via malicious plugins.xml file."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"https://0dd.zone/2018/10/28/uml-designer-XXE/","refsource":"MISC","url":"https://0dd.zone/2018/10/28/uml-designer-XXE/"},{"name":"https://github.com/ObeoNetwork/UML-Designer/issues/1035","refsource":"MISC","url":"https://github.com/ObeoNetwork/UML-Designer/issues/1035"}]}},"nvd":{"publishedDate":"2018-12-20 15:29:00","lastModifiedDate":"2019-09-11 16:53:00","problem_types":["CWE-611"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":10,"baseSeverity":"CRITICAL"},"exploitabilityScore":3.9,"impactScore":6},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":7.5},"severity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:obeo:uml_designer:*:*:*:*:*:*:*:*","versionEndIncluding":"8.0.0","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2018","CveId":"1000837","Ordinal":"140624","Title":"CVE-2018-1000837","CVE":"CVE-2018-1000837","Year":"2018"},"notes":[{"CveYear":"2018","CveId":"1000837","Ordinal":"1","NoteData":"UML Designer version <= 8.0.0 contains a XML External Entity (XXE) vulnerability in XML parser for plugins that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via malicious plugins.xml file.","Type":"Description","Title":null},{"CveYear":"2018","CveId":"1000837","Ordinal":"2","NoteData":"2018-12-20","Type":"Other","Title":"Published"}]}}}