9

CVE-2018-1000828

FrostWire version <= frostwire-desktop-6.7.4-build-272 contains a XML External Entity (XXE) vulnerability in Man in the middle on update that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via Man in the middle the call to update the software.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Frostwire ≫ Frostwire Version 1.9.9 Update build246 SwPlatform desktop
Frostwire ≫ Frostwire Version 1.9.9 Update build247 SwPlatform desktop
Frostwire ≫ Frostwire Version 2.0.7 Update build263 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.1.6 Update build166 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.1.6 Update build167 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.1.7 Update build168 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.1.8 Update build169 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.1.9 Update build172 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.2.0 Update build173 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.2.0 Update build174 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.2.1 Update build175 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.2.2 Update build176 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.2.3 Update build177 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.2.3 Update build178 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.2.4 Update build179 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.3.0 Update build180 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.3.0 Update build181 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.3.0 Update build182 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.3.0 Update build183 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.3.0 Update build184 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.3.0 Update build185 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.3.1 Update build186 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.3.2 Update build187 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.3.2 Update build188 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.3.3 Update build189 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.3.3 Update build190 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.3.3 Update build193 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.3.3 Update build255 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.3.4 Update build193 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.3.4 Update build194 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.3.5 Update build195 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.3.5 Update build197 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.3.5 Update build198 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.3.6 Update build201 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.3.6 Update build202 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.3.7 Update build203 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.3.7 Update build204 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.3.7 Update build205 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.3.7 Update build206 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.4.0 Update build207 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.4.0 Update build208 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.4.1 Update build209 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.4.1 Update build210 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.4.2 Update build212 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.4.3 Update build214 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.4.4 Update build215 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.4.5 Update build218 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.4.5 Update build219 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.4.5 Update build220 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.4.5 Update build221 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.4.5 Update build222 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.4.6 Update build223 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.4.6 Update build227 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.4.7 Update build228 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.4.7 Update build229 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.4.8 Update build230 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.4.8 Update build232 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.4.8 Update build233 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.4.8 Update build234 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.4.9 Update build235 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.5.0 Update build236 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.5.1 Update build238 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.5.2 Update build239 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.5.3 Update build240 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.5.4 Update build241 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.5.5 Update build242 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.5.5 Update build243 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.5.8 Update build244 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.5.8 Update build245 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.5.9 Update build246 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.6.0 Update build248 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.6.1 Update build249 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.6.2 Update build250 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.6.2 Update build251 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.6.3 Update build252 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.6.3 Update build253 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.6.4 Update build256 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.6.5 Update build257 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.6.6 Update build258 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.6.7 Update build529 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.6.8 Update build260 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.7.0 Update build261 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.7.0 Update build262 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.7.0 Update build264 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.7.0 Update build265hotfix SwPlatform desktop
Frostwire ≫ Frostwire Version 6.7.1 Update build266 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.7.1 Update build267 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.7.1 Update build268 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.7.2 Update build269 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.7.2 Update build270 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.7.3 Update build271 SwPlatform desktop
Frostwire ≫ Frostwire Version 6.7.4 Update build272 SwPlatform desktop
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.33% 0.674
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9 2.2 6
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
NIST 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-611 Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

https://0dd.zone/2018/10/28/frostwire-XXE-MitM/
Third Party Advisory
https://github.com/frostwire/frostwire/issues/829
Third Party Advisory
Issue Tracking