CVE-2018-1000830
Description
XR3Player version <= V3.124 contains a XML External Entity (XXE) vulnerability in Playlist parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
The AI Insight narrative is available to signed-in members. Sign in or create a free account to read it.
Affected products
1Patches
Discovered fix commits and diffs is available to signed-in members. Sign in or create a free account to read it.
Vulnerability mechanics
Root cause
"The XML parser in XR3Player is not configured to securely disable external entity resolution."
Attack vector
An attacker can provide a malicious playlist file containing a reference to an external XML entity. When XR3Player parses this playlist, the weakly configured XML parser will process the external entity, leading to various impacts. These impacts include disclosure of confidential data, denial of service, server-side request forgery, and port scanning from the perspective of the XR3Player host machine [ref_id=1]. The vulnerability is triggered when the application parses user-supplied XML content [ref_id=1].
Affected code
The vulnerability exists in the playlist parsing functionality of XR3Player. Specifically, the `ParsePlaylist.java` file at line 42 is mentioned as insecurely parsing user-supplied XML content [ref_id=1]. Additionally, the `JavaPlaylistParser/src/wseemann/media/jplaylistparser/parser/asx/ASXPlaylistParser.java` file at line 136 is cited for using `DocumentBuilderFactory` without securely disabling entities [ref_id=2].
What the fix does
The advisory recommends disabling external entity resolution in the XML parser to prevent XXE attacks [ref_id=2]. This involves configuring the `DocumentBuilderFactory` to not expand external entities, thereby mitigating the risk of malicious XML payloads. The patch does not show specific code changes, but the remediation guidance implies disabling entity expansion.
Preconditions
- inputThe attacker must supply a malicious XML playlist file.
Generated on Jun 5, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
2- 0dd.zone/2018/10/28/xr3player-XXE/mitrex_refsource_MISC
- github.com/goxr3plus/XR3Player/issues/9mitrex_refsource_MISC
News mentions
0No linked articles in our index yet.