CVE-2018-1000821

Severity: critical (CVSS 10.0 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-12-20 · updated 2026-06-17
Weakness: CWE-611

Description

MicroMathematics version before commit 5c05ac8 contains a XML External Entity (XXE) vulnerability in SMathStudio files that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via Specially crafted SMathStudio files. This vulnerability appears to have been fixed in after commit 5c05ac8.

Affected products

Micromathematics Project Micromathematics: before 2.17.3 — fixed in 2.17.3

How to fix

Upgrade to a fixed version: Micromathematics Project Micromathematics 2.17.3. Check the vendor advisory for mitigations.

References

https://0dd.zone/2018/10/27/micromathematics-XXE/
https://github.com/mkulesh/microMathematics/issues/79
https://0dd.zone/2018/10/27/micromathematics-XXE/
https://github.com/mkulesh/microMathematics/issues/79

Get alerted when CVE-2018-1000821 or the next vulnerability affects your stack