CVE-2013-3617

🗓️ 02 Nov 2013 19:00:00Reported by certccType

cve🔗 web.nvd.nist.gov👁 103 Views🌐 WEB

CVE-2013-3617: Openbravo ERP XML API allows remote users to read arbitrary files

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2013-3617	30 Oct 201300:00	–	circl
Check Point Advisories	Multiple Products XML Public External Entity Information Disclosure (CVE-2013-3617; CVE-2013-4152; CVE-2013-6429; CVE-2014-0002; CVE-2014-0423)	29 Sep 201300:00	–	checkpoint_advisories
Check Point Advisories	Multiple Products XML System External Entity Information Disclosure (CVE-2013-3617; CVE-2013-4152; CVE-2013-6429; CVE-2014-0002; CVE-2014-0054; CVE-2014-0423)	29 Sep 201300:00	–	checkpoint_advisories
Cvelist	CVE-2013-3617	2 Nov 201319:00	–	cvelist
Exploit DB	Openbravo ERP - XML External Entity Information Disclosure	30 Oct 201300:00	–	exploitdb
Metasploit	Openbravo ERP XXE Arbitrary File Read	30 Oct 201300:00	–	metasploit
NVD	CVE-2013-3617	2 Nov 201319:55	–	nvd
Packet Storm	Openbravo ERP XXE Arbitrary File Read	31 Aug 202400:00	–	packetstorm
Prion	Xxe	2 Nov 201319:55	–	prion
Positive Technologies	PT-2013-4522	2 Nov 201300:00	–	ptsecurity

NVD

Node

OR

openbravo openbravo_erpRange≤3.0

openbravo openbravo_erpMatch2.40

openbravo openbravo_erpMatch2.50

Source	Link
securityfocus	www.securityfocus.com/bid/63431
kb	www.kb.cert.org/vuls/id/533894
community	www.community.rapid7.com/community/metasploit/blog/2013/10/30/seven-tricks-and-treats

Parameter	Position	Path	Description	CWE
comments	request body	/openbravo/ws/dal/ADUser	XXE vulnerability in Openbravo ERP XML API: remote authenticated users can read arbitrary server files by sending an XML payload with an external entity (DOCTYPE with ENTITY) to the ADUser endpoint.	CWE-264

16 Jun 2026 23:55Current

6.5Medium risk

Vulners AI Score6.5

CVSS 23.5

EPSS0.21074

cve openbravo erp xml api remote users arbitrary files xxe nvd