CVE-2018-20298

Severity: medium (CVSS 6.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-12-19 · updated 2026-06-17
Weakness: CWE-611

Description

S3 Browser before 8.1.5 contains an XML external entity (XXE) vulnerability, allowing remote attackers to read arbitrary files and obtain NTLMv2 hash values by tricking a user into connecting to a malicious server via the S3 protocol.

Affected products

S3Browser S3 Browser: before 8.1.5 — fixed in 8.1.5

How to fix

Upgrade to a fixed version: S3Browser S3 Browser 8.1.5. Check the vendor advisory for mitigations.

References

https://s3browser.com/news.aspx
https://www.ptsecurity.com/ww-en/analytics/threatscape/pt-2018-34/
https://s3browser.com/news.aspx
https://www.ptsecurity.com/ww-en/analytics/threatscape/pt-2018-34/

Get alerted when CVE-2018-20298 or the next vulnerability affects your stack