CVE-2018-20298

S3 Browser before 8.1.5 contains an XML external entity (XXE) vulnerability, allowing remote attackers to read arbitrary files and obtain NTLMv2 hash values by tricking a user into connecting to a malicious server via the S3 protocol.

Score

CVSS 3.0 6.5 Medium

Status

Modified - cve@mitre.org

Published

2018-12-19

Last modified

2024-09-16

Weaknesses

CWE-611

Affected products

• S3 Browser (S3browser)

References

• https://s3browser.com/news.aspx
• https://www.ptsecurity.com/ww-en/analytics/threatscape/pt-2018-34/