CVE-2013-0315: XEE
The GateIn Portal Export / Import Gadget is vulnerable to XXE (XML eXternal Entity) attacks. If the XML provided to the import gadget contains an external XML entity, this XML entity will be resolved. A remote attacker who can access the import gadget could use this flaw to read files in the context of the user running the application server.
Other sources
The GateIn Portal export/import gadget in JBoss Enterprise Portal Platform 5.2.2 allows remote attackers to read arbitrary files via a crafted external XML entity in an XML document, aka an XML Entity Expansion (XEE) attack.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-0315?
CVE-2013-0315 is classified as a high severity vulnerability due to its potential for exploitation through XXE attacks.
How do I fix CVE-2013-0315?
To mitigate CVE-2013-0315, it is recommended to update to a patched version of the Red Hat JBoss Enterprise Portal Platform.
Which versions of software are affected by CVE-2013-0315?
CVE-2013-0315 affects Red Hat JBoss Enterprise Portal Platform version 5.2.2.
Can CVE-2013-0315 lead to remote code execution?
CVE-2013-0315 can allow an attacker to read sensitive files, but it does not directly lead to remote code execution.
Who is at risk from CVE-2013-0315?
Organizations using the affected version of Red Hat JBoss Enterprise Portal Platform are at risk if they allow untrusted XML input.