CVE-2013-1824

The SOAP parser in PHP before 5.3.22 and 5.4.x before 5.4.12 allows remote attackers to read arbitrary files via a SOAP WSDL file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue in the soap_xmlParseFile and soap_xmlParseMemory functions.

• CWE-611

• http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=188c196d4da60bdde9190d2fc532650d17f7af2d
• http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=afe98b7829d50806559acac9b530acb8283c3bf4
• http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.htmlBroken Link, Mailing List
• http://people.canonical.com/~ubuntu-security/cve/2013/CVE-2013-1824.htmlThird Party Advisory
• http://support.apple.com/kb/HT5880Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=918187Issue Tracking, Patch, Third Party Advisory
• http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=188c196d4da60bdde9190d2fc532650d17f7af2d
• http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=afe98b7829d50806559acac9b530acb8283c3bf4
• http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.htmlBroken Link, Mailing List
• http://people.canonical.com/~ubuntu-security/cve/2013/CVE-2013-1824.htmlThird Party Advisory
• http://support.apple.com/kb/HT5880Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=918187Issue Tracking, Patch, Third Party Advisory

Published

Sep 16, 2013

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-1818maintenance/mwdoc-filter.php in MediaWiki before 1.20.3 allo…
• CVE-2013-1819The _xfs_buf_find function in fs/xfs/xfs_buf.c in the Linux …
• CVE-2013-1820tuned before 2.x allows local users to kill running processe…5.5
• CVE-2013-1821lib/rexml/text.rb in the REXML parser in Ruby before 1.9.3-p…
• CVE-2013-1822Multiple cross-site scripting (XSS) vulnerabilities in ownCl…
• CVE-2013-1823Cross-site scripting (XSS) vulnerability in the Notification…
• CVE-2013-1825Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2013-1826The xfrm_state_netlink function in net/xfrm/xfrm_user.c in t…
• CVE-2013-1827net/dccp/ccid.h in the Linux kernel before 3.5.4 allows loca…
• CVE-2013-1828The sctp_getsockopt_assoc_stats function in net/sctp/socket.…
• CVE-2013-1829calendar/managesubscriptions.php in Moodle 2.4.x before 2.4.…
• CVE-2013-1830user/view.php in Moodle through 2.1.10, 2.2.x before 2.2.8, …