{"id":"CVE-2013-4701","aliases":["EUVD-2022-2640","GHSA-5qp6-78pr-gv8c","MGASA-2013-0272","UBUNTU-CVE-2013-4701"],"status":"published","title":"PHP OpenID Library Denial of Service vulnerability","description":"Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via XRDS data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02997,"percentile":0.87441,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2013-08-21T16:00:00Z","modified":"2026-06-16T23:57:44Z","fixes":[{"ecosystem":"Packagist","package":"openid/php-openid","fixed_in":["2.3.0"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist","package":"typo3/cms","fixed_in":["6.2.6"],"sources":["ghsa","osv"]},{"ecosystem":"Mageia:2","package":"php-pear-Auth_OpenID","fixed_in":["2.2.2-1.mga2"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"php-pear-Auth_OpenID","fixed_in":["2.2.2-1.mga3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"openid/php-openid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"typo3/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.2.6"}]}]},{"source":"osv","ecosystem":"Packagist","package":"openid/php-openid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0"}]}]},{"source":"osv","ecosystem":"Packagist","package":"typo3/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.2.6"}]}],"versions":["6.2.0","6.2.1","6.2.2","6.2.3","6.2.4","6.2.5"]},{"source":"osv","ecosystem":"Mageia:2","package":"php-pear-Auth_OpenID","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-1.mga2"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"php-pear-Auth_OpenID","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-1.mga3"}]}]}],"products":[{"vendor":"janrain","product":"php-openid"}],"references":[{"url":"https://github.com/openid/php-openid/commit/625c16bb28bb120d262b3f19f89c2c06cb9b0da9","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","web","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00028.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://jvndb.jvn.jp/jvndb/JVNDB-2013-000080","tags":["third-party-advisory","x_refsource_JVNDB","x_transferred","web","report"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-08/msg00083.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://jvn.jp/en/jp/JVN24713981/index.html","tags":["third-party-advisory","x_refsource_JVN","x_transferred","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4701","tags":["advisory"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/openid/php-openid/CVE-2013-4701.yaml","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2013-4701.yaml","tags":["web"]},{"url":"https://typo3.org/security/advisory/typo3-core-sa-2014-002","tags":["web"]},{"url":"https://github.com/advisories/GHSA-5qp6-78pr-gv8c"},{"url":"https://github.com/openid/php-openid","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2013-0272.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=11147","tags":["report"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2013-September/115039.html","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2013-4701","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4701","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2013-4701","description":"Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via XRDS data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.","status":"published","published":"2013-08-21T16:00:00Z","modified":"2024-08-06T16:52:27.043Z","updated_at":"2026-11-02T14:34:58.193873Z"}],"euvd":[{"id":"EUVD-2022-2640","description":"Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via XRDS data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.","status":"published","published":"2013-08-21T16:00:00Z","modified":"2024-08-06T16:52:27Z","updated_at":"2026-11-03T01:56:30.535587Z"}],"ghsa":[{"id":"GHSA-5qp6-78pr-gv8c","title":"PHP OpenID Library Denial of Service vulnerability","description":"Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via XRDS data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.","status":"published","published":"2022-05-17T03:46:28Z","modified":"2024-02-06T13:19:11Z","cwes":["CWE-400"],"updated_at":"2026-11-02T14:37:36.076201Z"}],"nvd":[{"id":"CVE-2013-4701","description":"Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via XRDS data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.","status":"published","published":"2013-08-21T16:55:11.31Z","modified":"2026-06-16T23:57:44.947Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:02:35.248411Z"}],"osv":[{"id":"GHSA-5qp6-78pr-gv8c","title":"PHP OpenID Library Denial of Service vulnerability","description":"Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via XRDS data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.","status":"published","published":"2022-05-17T03:46:28Z","modified":"2024-12-02T05:39:53.259051Z","cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:38.553953Z"},{"id":"MGASA-2013-0272","title":"Updated php-pear-Auth_OpenID package fixes security vulnerability","description":"Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote\nattackers to read arbitrary files, send HTTP requests to intranet\nservers, or cause a denial of service (CPU and memory consumption) via\nXRDS data containing an external entity declaration in conjunction with an\nentity reference, related to an XML External Entity (XXE) issue\n(CVE-2013-4701).\n","status":"published","published":"2013-09-13T20:07:12Z","modified":"2026-04-16T06:24:13.275800695Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"UBUNTU-CVE-2013-4701","description":"Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via XRDS data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.","status":"withdrawn","published":"2013-08-21T16:55:00Z","modified":"2025-07-16T07:31:24.67951Z","updated_at":"2026-11-02T15:54:07.421078Z"}]}}