CVE-2013-4701 PHP OpenID Library Denial of Service vulnerability
HighCVSS 7.5
EPSS 3.0%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via XRDS data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openid/php-openid(Packagist) | < 2.3.0 | 2.3.0 |
| typo3/cms(Packagist) | >= 6.2.0, < 6.2.6 | 6.2.6 |
| typo3/cms(Packagist) | = 6.2.0 | No fix listed |
| typo3/cms(Packagist) | = 6.2.1 | No fix listed |
| typo3/cms(Packagist) | = 6.2.2 | No fix listed |
| typo3/cms(Packagist) | = 6.2.3 | No fix listed |
| typo3/cms(Packagist) | = 6.2.4 | No fix listed |
| typo3/cms(Packagist) | = 6.2.5 | No fix listed |
| janrain php-openid | <= 2.2.2 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com exploit patch
- github.com exploit
- github.com exploit
- github.com product
- typo3.org
- JVN#24713981 third-party-advisory
- JVNDB-2013-000080 third-party-advisory
- openSUSE-SU-2016:2025 vendor-advisory
- openSUSE-SU-2016:2114 vendor-advisory
- github.com