CVE-2009-5135
The Java XML parser in Echo before 2.1.1 and 3.x before 3.0.b6 allows remote attackers to read...
CVE-2009-5135 is a medium vulnerability (CVSS 5.0) in Nextapp Echo, published May 2, 2013. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 9.92%, the 95th percentile. No source names a fixed version.
- Severity
- 5.0 MediumCVSS 2.0, NVD
- Exploit chance
- 9.92%EPSS, 95th percentile
- Exploitation
- None known1 public exploit
- Fixed in
- No fix listedNo source names one
Description
The Java XML parser in Echo before 2.1.1 and 3.x before 3.0.b6 allows remote attackers to read arbitrary files via a request containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Exploit likelihood
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | NextApp Echo < 2.1.1 - XML Injection | 2009-03-10 |
What each source reports
NVD Score used
The Java XML parser in Echo before 2.1.1 and 3.x before 3.0.b6 allows remote attackers to read arbitrary files via a request containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
- Record
CVE-2009-5135- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE ListNo score
The Java XML parser in Echo before 2.1.1 and 3.x before 3.0.b6 allows remote attackers to read arbitrary files via a request containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
- Record
CVE-2009-5135- Updated
- 2026-11-02
EUVDEUVD-2009-5090No score
The Java XML parser in Echo before 2.1.1 and 3.x before 3.0.b6 allows remote attackers to read arbitrary files via a request containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
- Record
EUVD-2009-5090- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vw3m-jmhx-vxc5No score
The Java XML parser in Echo before 2.1.1 and 3.x before 3.0.b6 allows remote attackers to read...
The Java XML parser in Echo before 2.1.1 and 3.x before 3.0.b6 allows remote attackers to read arbitrary files via a request containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
- Record
GHSA-vw3m-jmhx-vxc5- Weakness
- CWE-20
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
secunia.com/advisories/34218
sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20090305-0_echo_nextapp_xml_injection.txt
exchange.xforce.ibmcloud.com/vulnerabilities/49167
securityfocus.com/archive/1/501637/100/0/threaded
echo.nextapp.com/site/node/5742
exploit-db.com/exploits/8191
vupen.com/english/advisories/2009/0653
nvd.nist.gov/vuln/detail/CVE-2009-5135
github.com/advisories/GHSA-vw3m-jmhx-vxc5