CVE-2013-4202

The (1) backup (api/contrib/backups.py) and (2) volume transfer (contrib/volume_transfer.py) APIs in OpenStack Cinder Grizzly 2013.1.3 and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack. NOTE: this issue is due to an incomplete fix for CVE-2013-1664.

• CWE-399

• http://rhn.redhat.com/errata/RHSA-2013-1198.htmlPatch, Third Party Advisory
• http://www.ubuntu.com/usn/USN-2005-1Third Party Advisory
• https://bugs.launchpad.net/ossa/+bug/1190229Third Party Advisory
• http://rhn.redhat.com/errata/RHSA-2013-1198.htmlPatch, Third Party Advisory
• http://www.ubuntu.com/usn/USN-2005-1Third Party Advisory
• https://bugs.launchpad.net/ossa/+bug/1190229Third Party Advisory

Published

Sep 16, 2013

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-4196The object manager implementation (objectmanager.py) in Plon…
• CVE-2013-4197member_portrait.py in Plone 2.1 through 4.1, 4.2.x through 4…
• CVE-2013-4198mail_password.py in Plone 2.1 through 4.1, 4.2.x through 4.2…
• CVE-2013-4199(1) cb_decode.py and (2) linkintegrity.py in Plone 2.1 throu…
• CVE-2013-4200The isURLInPortal method in the URLTool class in in_portal.p…
• CVE-2013-4201Katello allows remote authenticated users to call the "syste…
• CVE-2013-4203The self.run_gpg function in lib/rgpg/gpg_helper.rb in the r…
• CVE-2013-4204Multiple cross-site scripting (XSS) vulnerabilities in the J…
• CVE-2013-4205Memory leak in the unshare_userns function in kernel/user_na…
• CVE-2013-4206Heap-based buffer underflow in the modmul function in sshbn.…
• CVE-2013-4207Buffer overflow in sshbn.c in PuTTY before 0.63 allows remot…
• CVE-2013-4208The rsa_verify function in PuTTY before 0.63 (1) does not cl…