CVE-2013-3617

The XML API in Openbravo ERP 2.5, 3.0, and earlier allows remote authenticated users to read arbitrary files via an XML document with an external entity declaration in conjunction with an entity reference to /ws/dal/ADUser or other /ws/dal/XXX interfaces, related to an XML External Entity (XXE) issue.

CVSS v2.0

3.5 LOWAV:N/AC:M/Au:S/C:P/I:N/A:N

EPSS

21.07% chance of exploitation in the next 30 days, 97th percentile

Published

2013-11-02

Updated

2024-09-17

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/openbravo_xxe.rb

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/38818

References

• CVE Record
• NVD entry

Related

• CVE-2013-3615
• CVE-2013-3619
• CVE-2013-3614
• CVE-2013-3623
• CVE-2013-3613
• CVE-2013-3628