CVE-2018-1000831

EUVD-2018-2023
K9Mail version <= v5.600 contains a XML External Entity (XXE) vulnerability in WebDAV response parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via malicious WebDAV server or intercept the reponse of a valid WebDAV server.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
10 CRITICAL
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 47%
Affected Products (NVD)
VendorProductVersion
k9mailk-9_mail
𝑥
≤ 5.600
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://0dd.zone/2018/10/28/k9mail-XXE-MitM/
https://github.com/k9mail/k-9/issues/3681
https://0dd.zone/2018/10/28/k9mail-XXE-MitM/
https://github.com/k9mail/k-9/issues/3681