Lucene search

GitHub Advisory DatabaseGHSA-5QP6-78PR-GV8C

HistoryMay 17, 2022 - 3:46 a.m.

PHP OpenID Library Denial of Service vulnerability

2022-05-1703:46:28

CWE-400

GitHub Advisory Database

github.com

0.006 Low

EPSS

Percentile

79.2%

JSON

Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via XRDS data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CPENameOperatorVersion
typo3/cmslt6.2.6
openid/php-openidlt2.3.0

CPE	Name	Operator	Version
	typo3/cms	lt	6.2.6
	openid/php-openid	lt	2.3.0

References

jvn.jp/en/jp/JVN24713981/index.html

jvndb.jvn.jp/jvndb/JVNDB-2013-000080

lists.opensuse.org/opensuse-security-announce/2016-08/msg00028.html

lists.opensuse.org/opensuse-updates/2016-08/msg00083.html

github.com/advisories/GHSA-5qp6-78pr-gv8c

github.com/FriendsOfPHP/security-advisories/blob/master/openid/php-openid/CVE-2013-4701.yaml

github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2013-4701.yaml

github.com/openid/php-openid/commit/625c16bb28bb120d262b3f19f89c2c06cb9b0da9

nvd.nist.gov/vuln/detail/CVE-2013-4701

typo3.org/security/advisory/typo3-core-sa-2014-002

0.006 Low

EPSS

Percentile

79.2%

JSON

Related for GHSA-5QP6-78PR-GV8C