CVE-2018-1000837

10.0 criticalEPSS 1.8%

Critical (10.0) in obeo uml designer. EPSS 1.8% chance of exploitation in the next 30 days.

UML Designer version <= 8.0.0 contains a XML External Entity (XXE) vulnerability in XML parser for plugins that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via malicious plugins.xml file.

Severity

CVSS 3.1

10.0 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS: 1.8% chance of exploitation in the next 30 days; higher than 78% of CVEs (scores of 2026-10-31)
CWE: CWE-611
Published: 2018-12-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

obeo:uml_designer

References

https://0dd.zone/2018/10/28/uml-designer-XXE/
https://github.com/ObeoNetwork/UML-Designer/issues/1035
https://0dd.zone/2018/10/28/uml-designer-XXE/
https://github.com/ObeoNetwork/UML-Designer/issues/1035

Check your stack JSON