CVE-2018-1000651

10.0 criticalEPSS 1.9%

Critical (10.0) in gchq stroom. EPSS 1.9% chance of exploitation in the next 30 days.

Stroom version <5.4.5 contains a XML External Entity (XXE) vulnerability in XML Parser that can result in disclosure of confidential data, denial of service, server side request forgery, port scanning. This attack appear to be exploitable via Specially crafted XML file.

Severity

CVSS 3.0

10.0 critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS: 1.9% chance of exploitation in the next 30 days; higher than 79% of CVEs (scores of 2026-10-31)
CWE: CWE-611
Published: 2018-08-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

gchq:stroom

References

https://0dd.zone/2018/08/08/stroom-XXE/
https://github.com/gchq/stroom/issues/813
https://0dd.zone/2018/08/08/stroom-XXE/
https://github.com/gchq/stroom/issues/813

Check your stack JSON