{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "The XML API in Openbravo ERP 2.5, 3.0, and earlier allows remote authenticated users to read arbitrary files via an XML document with an external entity declaration in conjunction with an entity reference to /ws/dal/ADUser or other /ws/dal/XXX interfaces, related to an XML External Entity (XXE) issue."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2013-11-02T19:00:00Z", "orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-tricks-and-treats"}, {"name": "VU#533894", "tags": ["third-party-advisory", "x_refsource_CERT-VN"], "url": "http://www.kb.cert.org/vuls/id/533894"}, {"name": "63431", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/63431"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cert@cert.org", "ID": "CVE-2013-3617", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The XML API in Openbravo ERP 2.5, 3.0, and earlier allows remote authenticated users to read arbitrary files via an XML document with an external entity declaration in conjunction with an entity reference to /ws/dal/ADUser or other /ws/dal/XXX interfaces, related to an XML External Entity (XXE) issue."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-tricks-and-treats", "refsource": "MISC", "url": "https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-tricks-and-treats"}, {"name": "VU#533894", "refsource": "CERT-VN", "url": "http://www.kb.cert.org/vuls/id/533894"}, {"name": "63431", "refsource": "BID", "url": "http://www.securityfocus.com/bid/63431"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T16:14:56.605Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-tricks-and-treats"}, {"name": "VU#533894", "tags": ["third-party-advisory", "x_refsource_CERT-VN", "x_transferred"], "url": "http://www.kb.cert.org/vuls/id/533894"}, {"name": "63431", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/63431"}]}]}, "cveMetadata": {"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "assignerShortName": "certcc", "cveId": "CVE-2013-3617", "datePublished": "2013-11-02T19:00:00Z", "dateReserved": "2013-05-21T00:00:00Z", "dateUpdated": "2024-09-17T02:36:55.070Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openbravo:openbravo_erp:*:*:*:*:*:*:*:*", "matchCriteriaId": "856429C7-7977-45DF-BA55-A319C87F22E3", "versionEndIncluding": "3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:openbravo:openbravo_erp:2.40:*:*:*:*:*:*:*", "matchCriteriaId": "36E5C029-509F-4005-B428-AC35F16F8A91", "vulnerable": true}, {"criteria": "cpe:2.3:a:openbravo:openbravo_erp:2.50:*:*:*:*:*:*:*", "matchCriteriaId": "0C864621-1CB9-4753-A184-3CD65FD01CFD", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The XML API in Openbravo ERP 2.5, 3.0, and earlier allows remote authenticated users to read arbitrary files via an XML document with an external entity declaration in conjunction with an entity reference to /ws/dal/ADUser or other /ws/dal/XXX interfaces, related to an XML External Entity (XXE) issue."}, {"lang": "es", "value": "La API XML en Openbravo ERP 2.5, 3.0 y anteriores permite a usuarios remotos autenticados leer archivos arbitrarios a trav\u00e9s de un documento XML con una declaraci\u00f3n de entidad externa en conjunci\u00f3n con una referencia de entidad en /ws/dal/ADUser u otra interfaz /ws/dal/XXX, esta relacionado con un problema XML External Entity (XXE)."}], "id": "CVE-2013-3617", "lastModified": "2025-04-11T00:51:21.963", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2013-11-02T19:55:04.523", "references": [{"source": "cret@cert.org", "tags": ["Exploit", "US Government Resource"], "url": "http://www.kb.cert.org/vuls/id/533894"}, {"source": "cret@cert.org", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/63431"}, {"source": "cret@cert.org", "url": "https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-tricks-and-treats"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "US Government Resource"], "url": "http://www.kb.cert.org/vuls/id/533894"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/63431"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-tricks-and-treats"}], "sourceIdentifier": "cret@cert.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-264"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}