CVE-2013-6025 XML external entity in n/a

What is CVE-2013-6025?

CVE-2013-6025 is a medium-severity vulnerability in n/a, published on 19 Oct 2013. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The XMLParse procedure in SAP Sybase Adaptive Server Enterprise (ASE) 15.7 ESD 2 allows remote authenticated users to read arbitrary files via a SQL statement containing an XML document with an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Weakness: CWE-94

Which versions are affected by CVE-2013-6025?

It affects 1 product.

Products include Sybase Adaptive Server Enterprise.

How do I fix CVE-2013-6025?

No fix has been published for CVE-2013-6025 yet. Limit exposure of the affected software until one is available.

Is CVE-2013-6025 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2013-6025 exists.

Public exploit code: 1 Exploit-DB entry.

Other vulnerabilities in n/a

• CVE-2013-6245 Code injection in n/a Critical 10.0
• CVE-2005-0441 Memory corruption in n/a Critical 10.0
• CVE-2016-7402 SQL injection in n/a Critical 9.8
• CVE-2013-6863 Privilege escalation in n/a Critical 9.0
• CVE-2013-6865 Code injection in n/a Critical 9.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-h5g5-5xcr-5wm9.