CVEvulnerability
CVE-2013-3617
3.5 LOW
Official page ↗
- Status
- Modified
- Published
- 2013-11-02
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 3.5 LOW — AV:N/AC:M/Au:S/C:P/I:N/A:N
- Weaknesses
- CWE-264
Description
The XML API in Openbravo ERP 2.5, 3.0, and earlier allows remote authenticated users to read arbitrary files via an XML document with an external entity declaration in conjunction with an entity reference to /ws/dal/ADUser or other /ws/dal/XXX interfaces, related to an XML External Entity (XXE) issue.
Affected configurations
• openbravo openbravo erp (<= 3.0)
• openbravo openbravo erp 2.40
• openbravo openbravo erp 2.50
Related
Weakness · not in database (1)
References
- http://www.kb.cert.org/vuls/id/533894 Exploit, US Government Resource
- http://www.securityfocus.com/bid/63431 Exploit
- https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-tricks-and-treats community.rapid7.com
- http://www.kb.cert.org/vuls/id/533894 Exploit, US Government Resource
- http://www.securityfocus.com/bid/63431 Exploit
- https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-tricks-and-treats community.rapid7.com