PT-2013-1369 · Expat+6 · Expat+6
Published
2013-02-19
·
Updated
2025-11-25
·
CVE-2013-0340
CVSS v2.0
6.8
Medium
| Vector | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
expat versions 2.1.0 and earlier
Description
The issue is related to the incorrect restriction of XML external entity references in the Expat XML parsing library. This can allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. The vulnerability can be exploited by sending crafted XML documents, potentially leading to resource consumption, sending HTTP requests to intranet servers, or reading arbitrary files. This is an XML External Entity (XXE) issue.
Recommendations
For expat versions 2.1.0 and earlier, update to version 2.4.1 to resolve the issue. As a temporary workaround, consider using the XML SetEntityDeclHandler function to properly handle entity expansion, or disable external entity expansion to minimize the risk of exploitation.
Exploit
Fix
DoS
XXE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Centos
Debian
Expat
Apple Macos
Red Hat
Red Os