CVE-2013-6440 Exposure of Sensitive Information to an Unauthorized Actor in OpenSAML
Remote attackers can read sensitive data via XML external entity attacks in Shibboleth OpenSAML-Java due to unsafe entity expansion settings.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-6440?
CVE-2013-6440 is a medium-severity vulnerability in n/a, published on 14 Feb 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The (1) BasicParserPool, (2) StaticBasicParserPool, (3) XML Decrypter, and (4) SAML Decrypter in Shibboleth OpenSAML-Java before 2.6.1 set the expandEntityReferences property to true, which allows remote attackers to conduct XML external entity (XXE) attacks via a crafted XML DOCTYPE declaration.
Weakness: CWE-200
Which versions are affected by CVE-2013-6440?
2 open source packages ship an affected version, including org.opensaml:opensaml. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
org.opensaml:opensaml Maven | All versions | 2.6.1 |
org.opensaml:opensaml Maven | All versions | 2.6.1 |
Products include Internet2 Opensaml, Shibboleth Opensaml.
How do I fix CVE-2013-6440?
Upgrade org.opensaml:opensaml to 2.6.1 or later.
Is CVE-2013-6440 being exploited?
There is no known exploitation of CVE-2013-6440 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-v723-58jv-2qc4.