CVE-2018-1000831

Severity: critical (CVSS 10.0 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-12-20 · updated 2026-06-17
Weakness: CWE-611

Description

K9Mail version <= v5.600 contains a XML External Entity (XXE) vulnerability in WebDAV response parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via malicious WebDAV server or intercept the reponse of a valid WebDAV server.

Affected products

K9Mail K-9 Mail: through 5.600

References

https://0dd.zone/2018/10/28/k9mail-XXE-MitM/
https://github.com/k9mail/k-9/issues/3681
https://0dd.zone/2018/10/28/k9mail-XXE-MitM/
https://github.com/k9mail/k-9/issues/3681

Get alerted when CVE-2018-1000831 or the next vulnerability affects your stack