CVE Vulnerabilities

CVE-2013-4335

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Published: Feb 07, 2020 | Modified: Feb 11, 2020
CVSS 3.x
9.8
CRITICAL
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
7.5 HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P
RedHat/V2
RedHat/V3
Ubuntu

opOpenSocialPlugin 0.8.2.1, > 0.9.9.2, 0.9.13, 1.2.6: Multiple XML External Entity Injection Vulnerabilities

Weakness

The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

Affected Software

Name Vendor Start Version End Version
Opopensocialplugin Openpne 0.9.9.2 0.9.9.2
Opopensocialplugin Openpne 0.9.13 0.9.13
Opopensocialplugin Openpne 1.2.6 1.2.6
Opopensocialplugin Openpne 0.8.2.1 0.8.2.1

Potential Mitigations

References