CVE-2013-0340: vulnerability in libexpat
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
8Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 19%
expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.
Affected products
libexpatRelated CVEs — libexpat
In the same product, most dangerous first.
References
http://openwall.com/lists/oss-security/2013/02/22/3https://cert-portal.siemens.com/productcert/html/ssa-398330.htmlhttp://seclists.org/fulldisclosure/2021/Oct/61http://seclists.org/fulldisclosure/2021/Oct/62http://seclists.org/fulldisclosure/2021/Oct/63http://seclists.org/fulldisclosure/2021/Sep/33http://seclists.org/fulldisclosure/2021/Sep/34http://seclists.org/fulldisclosure/2021/Sep/35http://seclists.org/fulldisclosure/2021/Sep/38http://seclists.org/fulldisclosure/2021/Sep/39http://seclists.org/fulldisclosure/2021/Sep/40http://securitytracker.com/id?1028213