CVE-2013-4701: High severity janrain php-openid vulnerability
Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via XRDS data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Other sources
Denial of Service in OpenID System Extension
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4701?
CVE-2013-4701 has been categorized as a high severity vulnerability due to its ability to allow remote file reading, HTTP requests to intranet servers, and potential denial of service.
How do I fix CVE-2013-4701?
To fix CVE-2013-4701, upgrade to PHP OpenID Library version 2.3.0 or TYPO3 CMS version 6.2.6 or later.
What systems are affected by CVE-2013-4701?
CVE-2013-4701 impacts versions of PHP OpenID Library up to 2.2.2 and TYPO3 CMS versions from 6.2.0 to 6.2.6.
What type of attack can CVE-2013-4701 facilitate?
CVE-2013-4701 can facilitate attacks that lead to unauthorized file access, internal network scanning, and denial of service through resource exhaustion.
Is CVE-2013-4701 easy to exploit?
Exploiting CVE-2013-4701 can be straightforward for an attacker with remote access due to its reliance on external entity declarations in XML.