{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "dateAssigned": "2018-08-19T00:00:00", "descriptions": [{"lang": "en", "value": "LatexDraw version <=4.0 contains a XML External Entity (XXE) vulnerability in SVG parsing functionality that can result in disclosure of data, server side request forgery, port scanning, possible rce. This attack appear to be exploitable via Specially crafted SVG file."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-08-20T19:00:00Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://0dd.zone/2018/08/05/LatexDraw-XXE/"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/arnobl/latexdraw/issues/10"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "DATE_ASSIGNED": "2018-08-19T17:09:33.135766", "DATE_REQUESTED": "2018-08-08T12:44:11", "ID": "CVE-2018-1000639", "REQUESTER": "sajeeb@0dd.zone", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "LatexDraw version <=4.0 contains a XML External Entity (XXE) vulnerability in SVG parsing functionality that can result in disclosure of data, server side request forgery, port scanning, possible rce. This attack appear to be exploitable via Specially crafted SVG file."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://0dd.zone/2018/08/05/LatexDraw-XXE/", "refsource": "MISC", "url": "https://0dd.zone/2018/08/05/LatexDraw-XXE/"}, {"name": "https://github.com/arnobl/latexdraw/issues/10", "refsource": "MISC", "url": "https://github.com/arnobl/latexdraw/issues/10"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T12:40:47.870Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://0dd.zone/2018/08/05/LatexDraw-XXE/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/arnobl/latexdraw/issues/10"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2018-1000639", "datePublished": "2018-08-20T19:00:00Z", "dateReserved": "2018-08-20T00:00:00Z", "dateUpdated": "2024-09-17T04:25:03.167Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:latexdraw_project:latexdraw:*:*:*:*:*:*:*:*", "matchCriteriaId": "37717FAE-F7D3-4A17-9E3C-3ACEBBFB00DF", "versionEndIncluding": "3.3.9", "vulnerable": true}, {"criteria": "cpe:2.3:a:latexdraw_project:latexdraw:4.0:beta1:*:*:*:*:*:*", "matchCriteriaId": "A35CB480-8A58-46AA-B908-66789C40BD20", "vulnerable": true}, {"criteria": "cpe:2.3:a:latexdraw_project:latexdraw:4.0:beta2:*:*:*:*:*:*", "matchCriteriaId": "168E806D-33EF-41D2-B04E-C2F65E16DD09", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "LatexDraw version <=4.0 contains a XML External Entity (XXE) vulnerability in SVG parsing functionality that can result in disclosure of data, server side request forgery, port scanning, possible rce. This attack appear to be exploitable via Specially crafted SVG file."}, {"lang": "es", "value": "LatexDraw en versiones 4.0 y anteriores contiene una vulnerabilidad XXE (XML External Entity) en la funcionalidad de an\u00e1lisis de SVG que puede resultar en la divulgaci\u00f3n de datos, Server-Side Request Forgery (SSRF), el escaneo de puertos y un posible RCE. Parece ser que este ataque puede ser explotado mediante un archivo SVG especialmente manipulado."}], "id": "CVE-2018-1000639", "lastModified": "2019-09-26T15:19:55.147", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-08-20T19:31:35.497", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://0dd.zone/2018/08/05/LatexDraw-XXE/"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://github.com/arnobl/latexdraw/issues/10"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-611"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}