NVD

Id
36686  
Name
CVE-2013-0340  
Description
expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-18  
Published
2014-01-21  
Modified Date
2014-01-22  
Seq
2013-0340  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
187503 36686 CVE-2013-0340 [oss-security] 20130221 CVEs for libxml2 and expat internal and external XML entity expansion  View
187504 36686 CVE-2013-0340 1028213  View
187505 36686 CVE-2013-0340 [oss-security] 20130413 Re-evaluating expat/libxml2 CVE assignments  View
187506 36686 CVE-2013-0340 58233  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
24299 JVNDB-2013-005874 Expat におけるサービス運用妨害 (DoS) の脆弱性 Expat は、アプリケーション開発者が XML_SetEntityDeclHandler 関数を使用していない場合、エンティティ拡張を適切に処理しないため、サービス運用妨害 (リソース消費) 状態にされる、イントラネットサーバに HTTP リクエストを送信される、または任意のファイルを読まれる脆弱性が存在します。 CVE-2013-0340 60282 CVE-2013-0340 36686 6.8 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-005874.html 2013-02-21 2014-01-23 View