CVE-2013-1665
XML External Entity (XXE) in Django
CVE-2013-1665 is a medium vulnerability (CVSS 5.0) in Openstack Folsom, published February 27, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.51%, the 91st percentile. Fixed in django 1.3.6.
The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) attack.
Exploit likelihood
What each source reports
NVD Score used
The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) attack.
- Record
CVE-2013-1665- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) attack.
- Record
CVE-2013-1665- Updated
- 2026-11-02
EUVDEUVD-2022-5723 No score
The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) attack.
- Record
EUVD-2022-5723- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x64m-686f-fmm3 No score
XML External Entity (XXE) in Django
The XML libraries for Python as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) attack.
- Record
GHSA-x64m-686f-fmm3- Weakness
- CWE-200, CWE-611
- Updated
- 2026-11-02
OSV No score
The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) attack.
- Record
CVE-2013-1665- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-1665 No score
The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) attack.
- Record
DEBIAN-CVE-2013-1665- Updated
- 2026-11-02
OSVGHSA-x64m-686f-fmm3 No score
XML External Entity (XXE) in Django
The XML libraries for Python as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) attack.
- Record
GHSA-x64m-686f-fmm3- Weakness
- CWE-200, CWE-611
- Updated
- 2026-11-02
OSVPYSEC-2026-802 No score
XML External Entity (XXE) in Django
The XML libraries for Python as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) attack.
- Record
PYSEC-2026-802- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
djangoPyPI |
1.3.0 up to 1.3.6 | 1.3.6 |
djangoPyPI |
1.4.0 up to 1.4.4 | 1.4.4 |
keystoneDebian:12 |
before 2012.1.1-13 | 2012.1.1-13 |
keystoneDebian:13 |
before 2012.1.1-13 | 2012.1.1-13 |
keystoneDebian:14 |
before 2012.1.1-13 | 2012.1.1-13 |
python-djangoDebian:12 |
before 1.4.4-1 | 1.4.4-1 |
python-djangoDebian:13 |
before 1.4.4-1 | 1.4.4-1 |
python-djangoDebian:14 |
before 1.4.4-1 | 1.4.4-1 |
python-djangoDebian:6.0 |
before 1.2.3-3+squeeze5, plus listed versions 1.2.3-31.2.3-3+squeeze11.2.3-3+squeeze21.2.3-3+squeeze3 |
1.2.3-3+squeeze5 |
djangoPyPI |
1.3.0 up to 1.3.6, plus listed versions 1.31.3.11.3.21.3.31.3.41.3.5 |
1.3.6 |
Show 22 moreShow less
| Package | Affected | Fixed |
|---|---|---|
djangoPyPI |
1.4.0 up to 1.4.4, plus listed versions 1.41.4.11.4.21.4.3 |
1.4.4 |
djangoPyPI |
1.3.0 up to 1.3.6, 1.4.0 up to 1.4.4, plus listed versions 1.31.3.11.3.21.3.31.3.4 Show 5 moreShow less1.3.51.41.4.11.4.21.4.3 |
1.3.61.4.4 |
openstack-keystoneRed Hat:openstack:2::el6 |
before 0:2012.2.3-3.el6ost | 0:2012.2.3-3.el6ost |
openstack-keystone-docRed Hat:openstack:2::el6 |
before 0:2012.2.3-3.el6ost | 0:2012.2.3-3.el6ost |
python-keystoneRed Hat:openstack:2::el6 |
before 0:2012.2.3-3.el6ost | 0:2012.2.3-3.el6ost |
openstack-novaRed Hat:openstack:2::el6 |
before 0:2012.2.3-4.el6ost | 0:2012.2.3-4.el6ost |
openstack-nova-apiRed Hat:openstack:2::el6 |
before 0:2012.2.3-4.el6ost | 0:2012.2.3-4.el6ost |
openstack-nova-certRed Hat:openstack:2::el6 |
before 0:2012.2.3-4.el6ost | 0:2012.2.3-4.el6ost |
openstack-nova-commonRed Hat:openstack:2::el6 |
before 0:2012.2.3-4.el6ost | 0:2012.2.3-4.el6ost |
openstack-nova-computeRed Hat:openstack:2::el6 |
before 0:2012.2.3-4.el6ost | 0:2012.2.3-4.el6ost |
openstack-nova-consoleRed Hat:openstack:2::el6 |
before 0:2012.2.3-4.el6ost | 0:2012.2.3-4.el6ost |
openstack-nova-docRed Hat:openstack:2::el6 |
before 0:2012.2.3-4.el6ost | 0:2012.2.3-4.el6ost |
openstack-nova-networkRed Hat:openstack:2::el6 |
before 0:2012.2.3-4.el6ost | 0:2012.2.3-4.el6ost |
openstack-nova-objectstoreRed Hat:openstack:2::el6 |
before 0:2012.2.3-4.el6ost | 0:2012.2.3-4.el6ost |
openstack-nova-schedulerRed Hat:openstack:2::el6 |
before 0:2012.2.3-4.el6ost | 0:2012.2.3-4.el6ost |
openstack-nova-volumeRed Hat:openstack:2::el6 |
before 0:2012.2.3-4.el6ost | 0:2012.2.3-4.el6ost |
python-novaRed Hat:openstack:2::el6 |
before 0:2012.2.3-4.el6ost | 0:2012.2.3-4.el6ost |
openstack-cinderRed Hat:openstack:2::el6 |
before 0:2012.2.3-4.el6ost | 0:2012.2.3-4.el6ost |
openstack-cinder-docRed Hat:openstack:2::el6 |
before 0:2012.2.3-4.el6ost | 0:2012.2.3-4.el6ost |
python-cinderRed Hat:openstack:2::el6 |
before 0:2012.2.3-4.el6ost | 0:2012.2.3-4.el6ost |
Django14Red Hat:openstack:2::el6 |
before 0:1.4.4-1.el6ost | 0:1.4.4-1.el6ost |
Django14-docRed Hat:openstack:2::el6 |
before 0:1.4.4-1.el6ost | 0:1.4.4-1.el6ost |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
openwall.com/lists/oss-security/2013/02/19/4
lists.openstack.org/pipermail/openstack-announce/2013-February/000078.html
rhn.redhat.com/errata/RHSA-2013-0658.html
ubuntu.com/usn/usn-1757-1
Show 61 moreShow less
debian.org/security/2013/dsa-2634
blog.python.org/2013/02/announcing-defusedxml-fixes-for-xml.html
bugs.python.org/issue17239
bugs.launchpad.net/keystone/+bug/1100279
nvd.nist.gov/vuln/detail/CVE-2013-1665
github.com/django/django/commit/1c60d07ba23e0350351c278ad28d0bd5aa410b40
security-tracker.debian.org/tracker/CVE-2013-1665
pypi.org/project/django
access.redhat.com/errata/RHSA-2013:0596
bugzilla.redhat.com/show_bug.cgi?id=908995
security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0596.json
cve.org/CVERecord?id=CVE-2013-0282