CVE-2013-4701
PHP OpenID Library Denial of Service vulnerability
CVE-2013-4701 is a high vulnerability (CVSS 7.5) in Janrain Php-openid, published August 21, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.00%, the 87th percentile. Fixed in openid/php-openid 2.3.0.
- Severity
- 7.5 HighCVSS 2.0, NVD
- Exploit chance
- 3.00%EPSS, 87th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.3.0openid/php-openid +4 more
Description
Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via XRDS data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
openid/php-openidPackagist | before 2.3.0 | 2.3.0 |
typo3/cmsPackagist | 6.2.0 up to 6.2.6 | 6.2.6 |
typo3/cmsPackagist | 6.2.0 up to 6.2.6, plus listed versions 6.2.16.2.26.2.36.2.46.2.5 | 6.2.6 |
php-pear-Auth_OpenIDMageia:2 | before 2.2.2-1.mga2 | 2.2.2-1.mga2 |
php-pear-Auth_OpenIDMageia:3 | before 2.2.2-1.mga3 | 2.2.2-1.mga3 |
What each source reports
NVD Score used
Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via XRDS data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
- Record
CVE-2013-4701- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE ListNo score
Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via XRDS data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
- Record
CVE-2013-4701- Updated
- 2026-11-02
EUVDEUVD-2022-2640No score
Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via XRDS data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
- Record
EUVD-2022-2640- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5qp6-78pr-gv8cNo score
PHP OpenID Library Denial of Service vulnerability
Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via XRDS data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
- Record
GHSA-5qp6-78pr-gv8c- Weakness
- CWE-400
- Updated
- 2026-11-02
OSVGHSA-5qp6-78pr-gv8cNo score
PHP OpenID Library Denial of Service vulnerability
Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via XRDS data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
- Record
GHSA-5qp6-78pr-gv8c- Weakness
- CWE-400
- Updated
- 2026-11-02
OSVMGASA-2013-0272No score
Updated php-pear-Auth_OpenID package fixes security vulnerability
Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via XRDS data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue (CVE-2013-4701).
- Record
MGASA-2013-0272- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-4701No score
Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via XRDS data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
- Record
UBUNTU-CVE-2013-4701- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/openid/php-openid/commit/625c16bb28bb120d262b3f19f89c2c06cb9b0da9
lists.opensuse.org/opensuse-security-announce/2016-08/msg00028.html
jvndb.jvn.jp/jvndb/JVNDB-2013-000080
jvn.jp/en/jp/JVN24713981/index.html
nvd.nist.gov/vuln/detail/CVE-2013-4701
Show 10 moreShow less
typo3.org/security/advisory/typo3-core-sa-2014-002
advisories.mageia.org/MGASA-2013-0272.html
bugs.mageia.org/show_bug.cgi?id=11147
lists.fedoraproject.org/pipermail/package-announce/2013-September/115039.html
ubuntu.com/security/CVE-2013-4701
cve.org/CVERecord?id=CVE-2013-4701