What is CVE-2018-1000124?

CVE-2018-1000124 is a critical-severity vulnerability in Scilico I\,_librarian, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 10.0/10. Published 2018-03-13.

How severe is CVE-2018-1000124?

Critical severity. CVSS v3 base score is 10.0 out of 10.

XXE in Scilico I\,_librarian

CVE-2018-1000124

I Librarian I-librarian version 4.8 and earlier contains a XML External Entity (XXE) vulnerability in line 154 of importmetadata.php(simplexml_load_string) that can result in an attacker reading the contents of a file and SSRF. This attack…

Vulnerability class: XXE (XML External Entity)

EPSS: 0.018 (76.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.

Affected products

Scilico I\,_librarian
N/a — versions n/a

Weakness classification (CWE)

References

cve@mitre.org (x_refsource_CONFIRM, Exploit, Third Party Advisory)

Frequently asked questions

What is CVE-2018-1000124?: CVE-2018-1000124 is a critical-severity vulnerability in Scilico I\,_librarian, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 10.0/10. Published 2018-03-13.
How severe is CVE-2018-1000124?: Critical severity. CVSS v3 base score is 10.0 out of 10.