CVE-2013-6440

Removed by vendor...

PT-2014-3116

Name of the Vulnerable Software and Affected Versions Shibboleth OpenSAML-Java versions prior to 2.6.1 Description The issue allows remote attackers to conduct XML external entity XXE attacks via a crafted XML DOCTYPE declaration. This is due to the expandEntityReferences property being set to tr...

CVE-2013-6440: Exposure of Sensitive Information to an Unauthorized Actor

The 1 BasicParserPool, 2 StaticBasicParserPool, 3 XML Decrypter, and 4 SAML Decrypter in Shibboleth OpenSAML-Java before 2.6.1 set the expandEntityReferences property to true, which allows remote attackers to conduct XML external entity XXE attacks via a crafted XML DOCTYPE declaration...

Java: XML eXternal Entity (XXE) flaw in ParserPool and Decrypter

It was found that the ParserPool and Decrypter classes in the OpenSAML Java implementation resolved external entities, permitting XML External Entity XXE attacks. A remote attacker could use this flaw to read files accessible to the user running the application server, and potentially perform oth...

Java: XML eXternal Entity (XXE) flaw in ParserPool and Decrypter

It was found that the ParserPool and Decrypter classes in the OpenSAML Java implementation resolved external entities, permitting XML External Entity XXE attacks. A remote attacker could use this flaw to read files accessible to the user running the application server, and potentially perform oth...