CVE-2013-4701 - Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote attackers to read arbitrary

CVE-2013-4701

Summary

Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via XRDS data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

References

Vulnerable Configurations

cpe:2.3:a:janrain:php-openid:2.2.2:*:*:*:*:*:*:*
cpe:2.3:a:janrain:php-openid:2.2.2:*:*:*:*:*:*:*

CVSS

Base:	7.5 (as of 28-11-2016 - 19:09)
Impact:
Exploitability:

CWE

NVD-CWE-noinfo

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:L/Au:N/C:P/I:P/A:P

refmap via4

confirm	https://github.com/openid/php-openid/commit/625c16bb28bb120d262b3f19f89c2c06cb9b0da9
jvn	JVN#24713981
jvndb	JVNDB-2013-000080
suse	openSUSE-SU-2016:2025 openSUSE-SU-2016:2114

Last major update

28-11-2016 - 19:09

Published

21-08-2013 - 16:55

Last modified

28-11-2016 - 19:09