What is CVE-2018-1000090?

CVE-2018-1000090 is a high-severity vulnerability in Textpattern, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 7.5/10. Published 2018-03-13.

How severe is CVE-2018-1000090?

High severity. CVSS v3 base score is 7.5 out of 10.

XXE in Textpattern

CVE-2018-1000090

textpattern version version 4.6.2 contains a XML Injection vulnerability in Import XML feature that can result in Denial of service in context to the web server by exhausting server memory resources. This attack appear to be exploitable via Uploading a specially crafted XML file.

Vulnerability class: XXE (XML External Entity)

EPSS: 0.014 (69.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Textpattern — versions 4.6.2
N/a — versions n/a

Weakness classification (CWE)

CWE-611 — Improper Restriction of XML External Entity Reference (XXE)

References

cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC, Issue Tracking)

Frequently asked questions

What is CVE-2018-1000090?: CVE-2018-1000090 is a high-severity vulnerability in Textpattern, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 7.5/10. Published 2018-03-13.
How severe is CVE-2018-1000090?: High severity. CVSS v3 base score is 7.5 out of 10.