Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS02anZ3LXJwdzQtZ2o0eM4AAe8S

Apache Shindig PHP Sensitive Information Disclosure

The gadget renderer in Apache Shindig 2.5.0 for PHP allows remote attackers to obtain sensitive information via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Permalink: https://github.com/advisories/GHSA-6jvw-rpw4-gj4x
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02anZ3LXJwdzQtZ2o0eM4AAe8S
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 2 years ago
Updated: 9 months ago

CVSS Score: 5.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Identifiers: GHSA-6jvw-rpw4-gj4x, CVE-2013-4295
References:

• https://nvd.nist.gov/vuln/detail/CVE-2013-4295
• http://archives.neohapsis.com/archives/bugtraq/2013-10/0104.html
• http://shindig.apache.org/security.html
• http://www.securityfocus.com/bid/63260
• https://github.com/advisories/GHSA-6jvw-rpw4-gj4x

Blast Radius: 1.0

Affected Packages