PT-2013-1369 · Expat+6 · Expat+6
Publicado
2013-02-19
·
Atualizado
2025-11-25
·
CVE-2013-0340
CVSS v2.0
6.8
Média
| Vetor | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
expat versions 2.1.0 and earlier
Description
The issue is related to the incorrect restriction of XML external entity references in the Expat XML parsing library. This can allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. The vulnerability can be exploited by sending crafted XML documents, potentially leading to resource consumption, sending HTTP requests to intranet servers, or reading arbitrary files. This is an XML External Entity (XXE) issue.
Recommendations
For expat versions 2.1.0 and earlier, update to version 2.4.1 to resolve the issue. As a temporary workaround, consider using the XML SetEntityDeclHandler function to properly handle entity expansion, or disable external entity expansion to minimize the risk of exploitation.
Exploit
Correção
DoS
XXE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Debian
Expat
Apple Macos
Red Hat
Red Os