CVE Vulnerabilities

CVE-2013-3617

Published: Nov 02, 2013 | Modified: Apr 11, 2025
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
3.5 LOW
AV:N/AC:M/Au:S/C:P/I:N/A:N
RedHat/V2
RedHat/V3
Ubuntu
root.io minimus.io echohq.com

The XML API in Openbravo ERP 2.5, 3.0, and earlier allows remote authenticated users to read arbitrary files via an XML document with an external entity declaration in conjunction with an entity reference to /ws/dal/ADUser or other /ws/dal/XXX interfaces, related to an XML External Entity (XXE) issue.

Affected Software

Name Vendor Start Version End Version
Openbravo_erp Openbravo * 3.0 (including)
Openbravo_erp Openbravo 2.40 (including) 2.40 (including)
Openbravo_erp Openbravo 2.50 (including) 2.50 (including)

References