PT-2013-1336 · Php+3 · Php+3

Arseniy Reutov

·

Publicado

2013-03-06

·

Atualizado

2024-06-15

·

CVE-2013-1643

CVSS v2.0

5.0

Média

VetorAV:N/AC:L/Au:N/C:P/I:N/A:N
Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.3.23 PHP versions 5.4.x prior to 5.4.13
Description The issue is related to an XML External Entity (XXE) problem in the soap xmlParseFile and soap xmlParseMemory functions, allowing remote attackers to read arbitrary files via a SOAP WSDL file containing an XML external entity declaration in conjunction with an entity reference. This can lead to the disclosure of protected information.
Recommendations For PHP versions prior to 5.3.23, update to version 5.3.23 or later. For PHP versions 5.4.x prior to 5.4.13, update to version 5.4.13 or later. As a temporary workaround, consider disabling the soap xmlParseFile and soap xmlParseMemory functions until a patch is available.

Exploit

Correção

Information Disclosure

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

BDU:2022-02633
CESA-2013_1615
CVE-2013-1643
DSA-2639-1
OPENSUSE-SU-2024:10290-1
OPENSUSE-SU-2024:10344-1
OPENSUSE-SU-2024:11169-1
RHSA-2013:1307
RHSA-2013:1615
RHSA-2013:1814
RHSA-2013_1307
RHSA-2013_1615
RHSA-2013_1814

Produtos afetados

Centos
Php
Red Hat
Suse