What is CVE-2018-1000844?

CVE-2018-1000844 is a critical-severity vulnerability in Squareup Retrofit, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 9.1/10. Published 2018-12-20.

How severe is CVE-2018-1000844?

Critical severity. CVSS v3 base score is 9.1 out of 10.

Is CVE-2018-1000844 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

XXE in Squareup Retrofit

CVE-2018-1000844

Square Open Source Retrofit version Prior to commit 4a693c5aeeef2be6c7ecf80e7b5ec79f6ab59437 contains a XML External Entity (XXE) vulnerability in JAXB that can result in An attacker could use this to remotely read files from the file system or to perform SSRF.. This vulnerability appears to have been fixed in After commit 4a693c5aeeef2be6c7ecf80e7b5ec79f6ab59437.

Vulnerability class: XXE (XML External Entity)

EPSS: 0.022 (80.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.

Affected products

Squareup Retrofit
N/a — versions n/a

Weakness classification (CWE)

CWE-611 — Improper Restriction of XML External Entity Reference (XXE)

Public proof-of-concept exploits

epicosy/Retrofit-1

References

cve@mitre.org (Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2018-1000844?: CVE-2018-1000844 is a critical-severity vulnerability in Squareup Retrofit, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 9.1/10. Published 2018-12-20.
How severe is CVE-2018-1000844?: Critical severity. CVSS v3 base score is 9.1 out of 10.
Is CVE-2018-1000844 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.