Strix
26.1K

CVE-2013-0340

UnknownEPSS 19.43%

Last modified

CVE-2013-0340 is a vulnerability of currently unknown severity. expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.. EPSS estimates a 19.43% chance of exploitation in the next 30 days.

Description

expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.

Metrics

EPSS Probability
19.43%

97.0th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
Libexpat ProjectLibexpat< 2.4.0
PythonPython>= 3.6.0, < 3.6.15
PythonPython>= 3.7.0, < 3.7.12
PythonPython>= 3.8.0, < 3.8.12
PythonPython>= 3.9.0, < 3.9.7
AppleIpados< 14.8
AppleIphone Os< 14.8
AppleMacos< 11.6
AppleTvos< 15.0
AppleWatchos< 8.0

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2013-0340?
expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.
How severe is CVE-2013-0340?
Severity scoring for CVE-2013-0340 is pending analysis. The EPSS model estimates a 19.43% probability of exploitation in the next 30 days.
How do I fix CVE-2013-0340?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2013-0340?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST