CVE-2018-1000651
Description
Stroom version <5.4.5 contains a XML External Entity (XXE) vulnerability in XML Parser that can result in disclosure of confidential data, denial of service, server side request forgery, port scanning. This attack appear to be exploitable via Specially crafted XML file.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2Patches
Vulnerability mechanics
Root cause
"The XML parser in Stroom version <5.4.5 does not disable external entity resolution."
Attack vector
An attacker can exploit this vulnerability by submitting a specially crafted XML file to the application. This XML file would contain a reference to an external entity, which the XML parser would then process. The processing of this external entity can lead to various impacts, including the disclosure of confidential data, denial of service, server-side request forgery, and port scanning [ref_id=1].
Affected code
The vulnerability exists in the XMLParser component of Stroom. Specifically, the code snippet provided shows the usage of `XMLReader` without disabling entities: `final XMLReader xmlReader = parser.getXMLReader(); xmlReader.setErrorHandler(new FatalErrorHandler()); xmlReader.setContentHandler(handler); xmlReader.parse(new InputSource(reader));` [ref_id=1].
What the fix does
The advisory does not specify the exact fix applied to resolve this vulnerability. However, the general remediation for XML External Entity (XXE) vulnerabilities involves configuring the XML parser to disable the resolution of external entities. This prevents the parser from fetching and processing external resources, thereby mitigating the risks associated with XXE attacks [ref_id=1].
Preconditions
- inputThe attacker must be able to submit a specially crafted XML file to the application.
Generated on Jun 4, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
2- 0dd.zone/2018/08/08/stroom-XXE/mitrex_refsource_MISC
- github.com/gchq/stroom/issues/813mitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.