NetSight
IP …
medium5.0

CVE-2013-6440

The (1) BasicParserPool, (2) StaticBasicParserPool, (3) XML Decrypter, and (4) SAML Decrypter in Shibboleth OpenSAML-Java before 2.6.1 set the expandEntityRefe…

Impact

The (1) BasicParserPool, (2) StaticBasicParserPool, (3) XML Decrypter, and (4) SAML Decrypter in Shibboleth OpenSAML-Java before 2.6.1 set the expandEntityReferences property to true, which allows remote attackers to conduct XML external entity (XXE) attacks via a crafted XML DOCTYPE declaration.

Affected products

VendorProductAffected versions
Internet2Opensaml
Versions 2.0, 2.1.0, 2.2.0
ShibbolethOpensaml
through 2.6.0
Versions 2.4.0, 2.4.1, 2.4.2, 2.4.3, 2.5.0

Weakness classification

CWE-200

References