CVE-2018-1000829

Severity: critical (CVSS 9.0 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-12-20 · updated 2026-06-17
Weakness: CWE-611

Description

Anyplace version before commit 80359b4 contains a XML External Entity (XXE) vulnerability in Man in the middle on map API call that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This vulnerability appears to have been fixed in after commit 80359b4.

Affected products

Anyplace Project Anyplace: all versions

References

https://0dd.zone/2018/10/28/anyplace-XXE-MitM/
https://github.com/dmsl/anyplace/issues/263
https://0dd.zone/2018/10/28/anyplace-XXE-MitM/
https://github.com/dmsl/anyplace/issues/263

Get alerted when CVE-2018-1000829 or the next vulnerability affects your stack