Unrated severityNVD Advisory· Published Nov 2, 2013· Updated Apr 29, 2026
CVE-2013-3617
CVE-2013-3617
Description
The XML API in Openbravo ERP 2.5, 3.0, and earlier allows remote authenticated users to read arbitrary files via an XML document with an external entity declaration in conjunction with an entity reference to /ws/dal/ADUser or other /ws/dal/XXX interfaces, related to an XML External Entity (XXE) issue.
Affected products
3cpe:2.3:a:openbravo:openbravo_erp:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:openbravo:openbravo_erp:*:*:*:*:*:*:*:*range: <=3.0
- cpe:2.3:a:openbravo:openbravo_erp:2.40:*:*:*:*:*:*:*
- cpe:2.3:a:openbravo:openbravo_erp:2.50:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- www.kb.cert.org/vuls/id/533894nvdExploitUS Government Resource
- www.securityfocus.com/bid/63431nvdExploit
- community.rapid7.com/community/metasploit/blog/2013/10/30/seven-tricks-and-treatsnvd
News mentions
0No linked articles in our index yet.