CVE-2013-4701
PHP OpenID Library Denial of Service vulnerability
Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via XRDS data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Exploit likelihood
What each source reports
NVD Score used
Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via XRDS data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
- Record
CVE-2013-4701- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via XRDS data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
- Record
CVE-2013-4701- Updated
- 2026-11-02
EUVDEUVD-2022-2640 No score
Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via XRDS data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
- Record
EUVD-2022-2640- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5qp6-78pr-gv8c No score
PHP OpenID Library Denial of Service vulnerability
Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via XRDS data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
- Record
GHSA-5qp6-78pr-gv8c- Weakness
- CWE-400
- Updated
- 2026-11-02
OSVGHSA-5qp6-78pr-gv8c No score
PHP OpenID Library Denial of Service vulnerability
Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via XRDS data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
- Record
GHSA-5qp6-78pr-gv8c- Weakness
- CWE-400
- Updated
- 2026-11-02
OSVMGASA-2013-0272 No score
Updated php-pear-Auth_OpenID package fixes security vulnerability
Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via XRDS data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue (CVE-2013-4701).
- Record
MGASA-2013-0272- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-4701 No score
Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via XRDS data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
- Record
UBUNTU-CVE-2013-4701- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
openid/php-openidPackagist |
before 2.3.0 | 2.3.0 |
typo3/cmsPackagist |
6.2.0 up to 6.2.6 | 6.2.6 |
typo3/cmsPackagist |
6.2.0 up to 6.2.6, plus listed versions 6.2.16.2.26.2.36.2.46.2.5 |
6.2.6 |
php-pear-Auth_OpenIDMageia:2 |
before 2.2.2-1.mga2 | 2.2.2-1.mga2 |
php-pear-Auth_OpenIDMageia:3 |
before 2.2.2-1.mga3 | 2.2.2-1.mga3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-4701 is a high vulnerability (CVSS 7.5) in Janrain Php-openid, published August 21, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.00%, the 87th percentile. Fixed in openid/php-openid 2.3.0.
References
github.com/openid/php-openid/commit/625c16bb28bb120d262b3f19f89c2c06cb9b0da9
lists.opensuse.org/opensuse-security-announce/2016-08/msg00028.html
jvndb.jvn.jp/jvndb/JVNDB-2013-000080
jvn.jp/en/jp/JVN24713981/index.html
nvd.nist.gov/vuln/detail/CVE-2013-4701
Show 10 moreShow less
typo3.org/security/advisory/typo3-core-sa-2014-002
advisories.mageia.org/MGASA-2013-0272.html
bugs.mageia.org/show_bug.cgi?id=11147
lists.fedoraproject.org/pipermail/package-announce/2013-September/115039.html
ubuntu.com/security/CVE-2013-4701
cve.org/CVERecord?id=CVE-2013-4701