Unscored CVE-2018-20298 EUVD-2018-12861GHSA-v2h5-c2mm-jm6r

S3 Browser before 8.1.5 contains an XML external entity (XXE) vulnerability, allowing remote attackers to read arbitrary files and obtain N…

Published Dec 19, 2018 · Updated Sep 16, 2024 · Assigned by mitre

Description

S3 Browser before 8.1.5 contains an XML external entity (XXE) vulnerability, allowing remote attackers to read arbitrary files and obtain NTLMv2 hash values by tricking a user into connecting to a malicious server via the S3 protocol.

References

https://www.ptsecurity.com/ww-en/analytics/threatscape/pt-2018-34/
https://s3browser.com/news.aspx