GitHub Advisoryadvisory · Maven

GHSA-6jvw-rpw4-gj4x Apache Shindig PHP Sensitive Information Disclosure

MEDIUM Published 2022-05-17 Modified 2023-08-29 Official page ↗
Aliases
CVE-2013-4295
Ecosystem
Maven
Packages
org.apache.shindig:shindig-php
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200
Reviewed
2023-08-29

Affected packages

• Maven org.apache.shindig:shindig-php: >= 2.5.0-beta1, < 2.5.0-update1 → fixed in 2.5.0-update1

Description

The gadget renderer in Apache Shindig 2.5.0 for PHP allows remote attackers to obtain sensitive information via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Related

Alias · CVE (1)

  • CVE-2013-4295 The gadget renderer in Apache Shindig 2.5.0 for PHP allows remote attackers to obtain sensitive information via an XML document containing… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References