CVE-2018-1000844

    Dashboard / Vulnerabilities / CVE-2018-1000844

    CVE-2018-1000844

    Published: 20 Dec 2018Last Modified: 27 Aug 2026

    Summary:

    Details: Square Open Source Retrofit version Prior to commit 4a693c5aeeef2be6c7ecf80e7b5ec79f6ab59437 contains a XML External Entity (XXE) vulnerability in JAXB that can result in An attacker could use this to remotely read files from the file system or to perform SSRF.. This vulnerability appears to have been fixed in After commit 4a693c5aeeef2be6c7ecf80e7b5ec79f6ab59437.

    References: https://github.com/square/retrofit/pull/2735

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 7158698314daa138e993fac6a590ed19d78a8599
    Fixed -40621bf538f6d48af182350adc880406c53dc67c

    Affected versions

    parent-2.4.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High