CVE-2013-3617

Published: Nov 2, 2013Modified: Apr 29, 2026

3.5

Vector

AV:N/AC:M/Au:S/C:P/I:N/A:N

Exploitability: 6.8 / Impact: 2.9

Source: NVD

Description

The XML API in Openbravo ERP 2.5, 3.0, and earlier allows remote authenticated users to read arbitrary files via an XML document with an external entity declaration in conjunction with an entity reference to /ws/dal/ADUser or other /ws/dal/XXX interfaces, related to an XML External Entity (XXE) issue.

Affected (3)

Products: Openbravo: Openbravo Erp

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Openbravo Openbravo Erp	Up to 3.0
Openbravo Openbravo Erp	Version 2.40
Openbravo Openbravo Erp	Version 2.50

Related CWEs

References (6)

http://www.kb.cert.org/vuls/id/533894

Source: cret@cert.org

ExploitUS Government Resource

http://www.securityfocus.com/bid/63431

Source: cret@cert.org

Exploit

https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-tricks-and-treats

Source: cret@cert.org

http://www.kb.cert.org/vuls/id/533894

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitUS Government Resource

http://www.securityfocus.com/bid/63431

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-tricks-and-treats

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.