Strix
26.1K

CVE-2013-6440

UnknownEPSS 2.75%

Last modified

CVE-2013-6440 is a vulnerability of currently unknown severity. The (1) BasicParserPool, (2) StaticBasicParserPool, (3) XML Decrypter, and (4) SAML Decrypter in Shibboleth OpenSAML-Java before 2.6.1 set the expandEntityReferences property to true, which allows remote attackers to conduct XML external entity (XXE) attacks via a crafted XML DOCTYPE declaration.. EPSS estimates a 2.75% chance of exploitation in the next 30 days.

Description

The (1) BasicParserPool, (2) StaticBasicParserPool, (3) XML Decrypter, and (4) SAML Decrypter in Shibboleth OpenSAML-Java before 2.6.1 set the expandEntityReferences property to true, which allows remote attackers to conduct XML external entity (XXE) attacks via a crafted XML DOCTYPE declaration.

Metrics

EPSS Probability
2.75%

84.3th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
Internet2Opensaml2.0
Internet2Opensaml2.1.0
Internet2Opensaml2.2.0
ShibbolethOpensaml<= 2.6.0
ShibbolethOpensaml2.4.0
ShibbolethOpensaml2.4.1
ShibbolethOpensaml2.4.2
ShibbolethOpensaml2.4.3
ShibbolethOpensaml2.5.0
ShibbolethOpensaml2.5.1
ShibbolethOpensaml2.5.2
ShibbolethOpensaml2.5.3

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2013-6440?
The (1) BasicParserPool, (2) StaticBasicParserPool, (3) XML Decrypter, and (4) SAML Decrypter in Shibboleth OpenSAML-Java before 2.6.1 set the expandEntityReferences property to true, which allows remote attackers to conduct XML external entity (XXE) attacks via a crafted XML DOCTYPE declaration.
How severe is CVE-2013-6440?
Severity scoring for CVE-2013-6440 is pending analysis. The EPSS model estimates a 2.75% probability of exploitation in the next 30 days.
How do I fix CVE-2013-6440?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2013-6440?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST