CVE-2013-4701
Last modified
CVE-2013-4701 is a vulnerability of currently unknown severity. Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via XRDS data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.. EPSS estimates a 3.00% chance of exploitation in the next 30 days.
Description
Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via XRDS data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Metrics
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Janrain | Php-Openid | <= 2.2.2 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2013-4701?
How severe is CVE-2013-4701?
How do I fix CVE-2013-4701?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2013
- CVE-2013-4695Winamp 5.63: Invalid Pointer Dereference leading to Arbitrar…7.8
- CVE-2013-4696Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
- CVE-2013-4697Multiple unspecified vulnerabilities in Hitachi JP1/IT Deskt…
- CVE-2013-4698Cybozu Mailwise 5.0.4 and 5.0.5 allows remote authenticated …
- CVE-2013-4699The Yahoo! Japan Yafuoku! application 4.3.0 and earlier for …
- CVE-2013-4700The Yahoo! Japan Shopping application 1.4 and earlier for An…
- CVE-2013-4702Multiple directory traversal vulnerabilities in the doApiAct…
- CVE-2013-4703Cross-site scripting (XSS) vulnerability in the top-page cus…
- CVE-2013-4704Cross-site scripting (XSS) vulnerability in ChamaNet ChamaCa…
- CVE-2013-4705Cross-site scripting (XSS) vulnerability in Opera before 15.…
- CVE-2013-4706The SSH implementation on the D-Link Japan DWL-2100AP with f…
- CVE-2013-4707The SSH implementation on D-Link Japan DES-3810 devices with…
Are you affected by CVE-2013-4701?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST