CVE-2013-3617

Опубликовано: 02 нояб. 2013

Источник: nvd

CVSS2: 3.5

EPSS Средний

Описание

The XML API in Openbravo ERP 2.5, 3.0, and earlier allows remote authenticated users to read arbitrary files via an XML document with an external entity declaration in conjunction with an entity reference to /ws/dal/ADUser or other /ws/dal/XXX interfaces, related to an XML External Entity (XXE) issue.

Ссылки

http://www.kb.cert.org/vuls/id/533894
Exploit
US Government Resource
http://www.securityfocus.com/bid/63431
Exploit
https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-tricks-and-treats
http://www.kb.cert.org/vuls/id/533894
Exploit
US Government Resource
http://www.securityfocus.com/bid/63431
Exploit
https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-tricks-and-treats

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:openbravo:openbravo_erp:*:*:*:*:*:*:*:*

Версия до 3.0 (включая)

cpe:2.3:a:openbravo:openbravo_erp:2.40:*:*:*:*:*:*:*

cpe:2.3:a:openbravo:openbravo_erp:2.50:*:*:*:*:*:*:*

EPSS

Процентиль: 98%

0.5674

Средний

3.5 Low

CVSS2

Дефекты

CWE-264

Связанные уязвимости

GHSA-2gjx-c22x-h568

github

больше 3 лет назад