VULNERABILITY INTELLIGENCE

CVE-2018-1000840

CVSS score6.5 MEDIUM

EPSS probability2.18%

CISA KEVNot currently listed

Published2018-12-20

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Description

Processing Foundation Processing version 3.4 and earlier contains a XML External Entity (XXE) vulnerability in loadXML() function that can result in An attacker can read arbitrary files and exfiltrate their contents via HTTP requests. This attack appear to be exploitable via The victim must use Processing to parse a crafted XML document.

Weakness classification

nvd@nist.gov: CWE-611

Primary references

cve@mitre.org — Exploit, Patch, Third Party Advisory
cve@mitre.org — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory