Vulnerability Details : CVE-2019-18213
Potential exploit
XML Language Server (aka lsp4xml) before 0.9.1, as used in Red Hat XML Language Support (aka vscode-xml) before 0.9.1 for Visual Studio and other products, allows XXE via a crafted XML document, with resultant SSRF (as well as SMB connection initiation that can lead to NetNTLM challenge/response capture for password cracking). This occurs in extensions/contentmodel/participants/diagnostics/LSPXMLParserConfiguration.java.
Vulnerability category: XML external entity (XXE) injectionServer-side request forgery (SSRF)
Products affected by CVE-2019-18213
- cpe:2.3:a:eclipse:wild_web_developer:-:*:*:*:*:*:*:*
- cpe:2.3:a:xml_language_server_project:xml_server_project:*:*:*:*:*:*:*:*
- cpe:2.3:a:theia_xml_extension_project:theia_xml_extension:-:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2019-18213
0.62%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 68 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2019-18213
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.5
|
MEDIUM | AV:N/AC:L/Au:S/C:P/I:P/A:P |
8.0
|
6.4
|
NIST | |
|
8.8
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST |
CWE ids for CVE-2019-18213
-
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.Assigned by: nvd@nist.gov (Primary)
References for CVE-2019-18213
-
https://github.com/angelozerr/lsp4xml/
GitHub - angelozerr/lsp4xml: XML Language ServerProduct
-
https://github.com/angelozerr/lsp4xml/blob/master/CHANGELOG.md#others
lsp4xml/CHANGELOG.md at master · angelozerr/lsp4xml · GitHubRelease Notes;Third Party Advisory
-
https://github.com/redhat-developer/vscode-xml/
GitHub - redhat-developer/vscode-xml: Editing XML in Visual Studio Code made easyPatch;Third Party Advisory
-
https://github.com/angelozerr/lsp4xml/pull/566
Add disallowDocTypeDecl & resolveExternalEntities validation settings by angelozerr · Pull Request #566 · angelozerr/lsp4xml · GitHubPatch;Third Party Advisory
-
https://marketplace.visualstudio.com/items?itemName=redhat.vscode-xml
XML - Visual Studio MarketplaceThird Party Advisory
-
https://www.shielder.it/blog/dont-open-that-xml-xxe-to-rce-in-xml-plugins-for-vs-code-eclipse-theia/
Don't open that XML: XXE to RCE in XML plugins for VS Code, Eclipse, Theia, ... - ShielderExploit;Third Party Advisory
Jump to