low3.5Public exploit code
CVE-2013-3617
The XML API in Openbravo ERP 2.5, 3.0, and earlier allows remote authenticated users to read arbitrary files via an XML document with an external entity declar…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Openbravo ERP - XML External Entity Information Disclosure2013-10-30 · remote · multiple · Verified
Impact
The XML API in Openbravo ERP 2.5, 3.0, and earlier allows remote authenticated users to read arbitrary files via an XML document with an external entity declaration in conjunction with an entity reference to /ws/dal/ADUser or other /ws/dal/XXX interfaces, related to an XML External Entity (XXE) issue.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Openbravo | Openbravo Erp | through 3.0 Versions 2.40, 2.50 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.kb.cert.org/vuls/id/533894
- http://www.securityfocus.com/bid/63431
- https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-tricks-and-treats
- http://www.kb.cert.org/vuls/id/533894
- http://www.securityfocus.com/bid/63431
- https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-tricks-and-treats