CVE-2013-3617
The XML API in Openbravo ERP 2.5, 3.0, and earlier allows remote authenticated users to read arbitrary files via an XML document with an external entity declaration in conjunction with an entity reference to /ws/dal/ADUser or other /ws/dal/XXX…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 21.1%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.
Description
The XML API in Openbravo ERP 2.5, 3.0, and earlier allows remote authenticated users to read arbitrary files via an XML document with an external entity declaration in conjunction with an entity reference to /ws/dal/ADUser or other /ws/dal/XXX interfaces, related to an XML External Entity (XXE) issue.
- CVSS 2.0
- 3.5 LOWAV:N/AC:M/Au:S/C:P/I:N/A:N
- EPSS
- 21.07% probability · 97th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- openbravo/openbravo erp
- Source
- cret@cert.org
References
- http://www.kb.cert.org/vuls/id/533894Exploit, US Government Resource
- http://www.securityfocus.com/bid/63431Exploit
- https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-tricks-and-treats
- http://www.kb.cert.org/vuls/id/533894Exploit, US Government Resource
- http://www.securityfocus.com/bid/63431Exploit
- https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-tricks-and-treats
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.