« Back to list

CVE-2018-1000835

Status: ModifiedCritical (10)—

KeePassDX version <= 2.5.0.0beta17 contains a XML External Entity (XXE) vulnerability in kdbx file parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Keepassdx — Keepass DX

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2018-1000835",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 10,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-12-20T15:29:01.610",
  "references": [
    {
      "url": "https://0dd.zone/2018/10/28/KeePassDX-XXE/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/Kunzisoft/KeePassDX/issues/200",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://0dd.zone/2018/10/28/KeePassDX-XXE/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/Kunzisoft/KeePassDX/issues/200",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-611"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "KeePassDX version <= 2.5.0.0beta17 contains a XML External Entity (XXE) vulnerability in kdbx file parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning."
    },
    {
      "lang": "es",
      "value": "KeePassDX, en versiones iguales o anteriores a la 2.5.0.0beta17, contiene una vulnerabilidad XEE (XML External Entity) en el analizador de archivos kdbx que puede resultar en la divulgación de datos confidenciales, denegación de servicio, SSRF o escaneo de puertos."
    }
  ],
  "lastModified": "2026-06-17T01:33:08.707",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FDEF3A3F-4F7E-40A2-9D54-90A12FC69BA0"
            },
            {
              "criteria": "cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta10:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7A080CE1-892A-45C5-8270-151440455AD2"
            },
            {
              "criteria": "cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta11:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DDEF2FD0-8A9E-469D-8CAA-67E9B54A571F"
            },
            {
              "criteria": "cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta12:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "95BD174C-342F-489D-8F28-B7ECB974A334"
            },
            {
              "criteria": "cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta13:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2E176DD3-81D3-4E56-8B24-4CFF97DEAFF3"
            },
            {
              "criteria": "cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta14:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3C0F1C7B-90D5-455E-B054-F059F11DFE2C"
            },
            {
              "criteria": "cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta15:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9C4A92A1-456B-4A0D-A914-A060B8180762"
            },
            {
              "criteria": "cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta16:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AB55EEEC-9D5C-4FB7-97B9-40C29C8C8C1F"
            },
            {
              "criteria": "cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta17:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "79891186-F5EE-4208-B141-C3760AE8DC8B"
            },
            {
              "criteria": "cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9C936C0D-AC70-48F3-8AB1-55B575CE07C3"
            },
            {
              "criteria": "cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7FC5033E-0B61-45B0-8E50-0E5149610EF8"
            },
            {
              "criteria": "cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "36F13105-AB21-4FFE-B16F-97CB34578011"
            },
            {
              "criteria": "cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "287C3518-9234-4C1A-B742-29C119F1F232"
            },
            {
              "criteria": "cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D9835F42-C0E2-48C7-867C-0EF6B3F5C75E"
            },
            {
              "criteria": "cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "332DAF45-6DC2-4698-B498-29E3A3E75137"
            },
            {
              "criteria": "cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F7BD9C0A-00E3-45F4-ADCA-692B25243910"
            },
            {
              "criteria": "cpe:2.3:a:keepassdx:keepass_dx:2.5.0.0:beta9:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7BB3AD0A-B0C1-4F95-B31B-19FD31322AEF"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}