CVE-2013-6440

 

Published at: - 14-02-2014 04:55

Last modified: - 07-02-2022 05:15

Total changes: - 2

Description

The (1) BasicParserPool, (2) StaticBasicParserPool, (3) XML Decrypter, and (4) SAML Decrypter in Shibboleth OpenSAML-Java before 2.6.1 set the expandEntityReferences property to true, which allows remote attackers to conduct XML external entity (XXE) attacks via a crafted XML DOCTYPE declaration.

Common Vulnerability Scoring System (CVSS)

AV:N/AC:L/Au:N/C:P/I:N/A:N

 

Verification logic

 

Reference

• http://blog.sendsafely.com/post/69590974866/web-based-single-sign-on-and-the-dangers-of-saml-xml
• RHSA-2014:0170-
• RHSA-2014:0171-
• https://bugzilla.redhat.com/show_bug.cgi?id=1043332
• RHSA-2014:0172-
• http://shibboleth.net/community/advisories/secadv_20131213.txt
• RHSA-2014:0195-
• https://www.oracle.com/security-alerts/cpujan2022.html

 

Keywords

NVD

 

CVE-2013-6440

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures