PT-2013-1336 · Php+3 · Php+3

Arseniy Reutov · Published 2013-03-06 · Updated 2024-06-15 · CVE-2013-1643

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.3.23 PHP versions 5.4.x prior to 5.4.13

Description The issue is related to an XML External Entity (XXE) problem in the soap xmlParseFile and soap xmlParseMemory functions, allowing remote attackers to read arbitrary files via a SOAP WSDL file containing an XML external entity declaration in conjunction with an entity reference. This can lead to the disclosure of protected information.

Recommendations For PHP versions prior to 5.3.23, update to version 5.3.23 or later. For PHP versions 5.4.x prior to 5.4.13, update to version 5.4.13 or later. As a temporary workaround, consider disabling the soap xmlParseFile and soap xmlParseMemory functions until a patch is available.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2022-02633

CESA-2013_1615

CVE-2013-1643

DSA-2639-1

OPENSUSE-SU-2024:10290-1

OPENSUSE-SU-2024:10344-1

OPENSUSE-SU-2024:11169-1

RHSA-2013:1307

RHSA-2013:1615

RHSA-2013:1814

RHSA-2013_1307

RHSA-2013_1615

RHSA-2013_1814

Affected Products

Centos

Php

Red Hat

Suse

References · 167

• 🔥 https://github.com/shelld3v/CVE-2012-2688 · Exploit
• http://debian.org/security/2013/dsa-2639 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00034.html · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2013:114 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00006.html · Vendor Advisory
• http://ubuntu.com/usn/USN-1761-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02620 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4248 · Security Note
• http://rhn.redhat.com/errata/RHSA-2013-1615.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2013-1615.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-7243 · Security Note
• https://bdu.fstec.ru/vul/2022-02597 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10290-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02631 · Security Note