CVEvulnerability

CVE-2013-0340

6.8 MEDIUM Published 2014-01-21 Modified 2026-10-14 Official page ↗
Status
Modified
Published
2014-01-21
Last modified
2026-10-14
Assigner
[email protected]
CVSS 2.0 ([email protected])
6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
CWE-611

Description

expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.

Affected configurations

• libexpat project libexpat (< 2.4.0) • python python (>= 3.6.0 < 3.6.15) • python python (>= 3.7.0 < 3.7.12) • python python (>= 3.8.0 < 3.8.12) • python python (>= 3.9.0 < 3.9.7) • apple ipados (< 14.8) • apple iphone os (< 14.8) • apple macos (< 11.6) • apple tvos (< 15.0) • apple watchos (< 8.0)

Related

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References