CVE-2013-3617

2022-10-0316:14:44

certcc

www.cve.org

openbravo erp

xml api

remote authenticated users

arbitrary files

xxe issue

6.3 Medium

AI Score

Confidence

Low

0.299 Low

EPSS

Percentile

97.0%

JSON

The XML API in Openbravo ERP 2.5, 3.0, and earlier allows remote authenticated users to read arbitrary files via an XML document with an external entity declaration in conjunction with an entity reference to /ws/dal/ADUser or other /ws/dal/XXX interfaces, related to an XML External Entity (XXE) issue.