GitHub Advisory DatabaseGHSA-5QP6-78PR-GV8CPHP OpenID Library Denial of Service vulnerability
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.006 Low
EPSS
Percentile
79.3%
Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via XRDS data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| typo3/cms | lt | 6.2.6 | |
| openid/php-openid | lt | 2.3.0 |
References
jvn.jp/en/jp/JVN24713981/index.html
jvndb.jvn.jp/jvndb/JVNDB-2013-000080
lists.opensuse.org/opensuse-security-announce/2016-08/msg00028.html
lists.opensuse.org/opensuse-updates/2016-08/msg00083.html
github.com/advisories/GHSA-5qp6-78pr-gv8c
github.com/FriendsOfPHP/security-advisories/blob/master/openid/php-openid/CVE-2013-4701.yaml
github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2013-4701.yaml
github.com/openid/php-openid/commit/625c16bb28bb120d262b3f19f89c2c06cb9b0da9
nvd.nist.gov/vuln/detail/CVE-2013-4701
typo3.org/security/advisory/typo3-core-sa-2014-002
Related
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.006 Low
EPSS
Percentile
79.3%