VYPR
← All advisories
High severityNVD Advisory· Published Aug 21, 2013· Updated Apr 29, 2026

CVE-2013-4701

CVE-2013-4701

Description

Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via XRDS data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
openid/php-openidPackagist
< 2.3.02.3.0
typo3/cmsPackagist
>= 6.2.0, < 6.2.66.2.6

Affected products

1

Patches

1
625c16bb28bb

disable external XML entities and libxml errors

https://github.com/openid/php-openidWill NorrisAug 12, 2013via ghsa
commit
1 file changed · +8 −1
  • Auth/Yadis/XML.php+8 −1 modified
    @@ -234,7 +234,14 @@ function setXML($xml_string)
             return false;
         }
 
-        if (!@$this->doc->loadXML($xml_string)) {
+        // disable external entities and libxml errors
+        $loader = libxml_disable_entity_loader(true);
+        $errors = libxml_use_internal_errors(true);
+        $parse_result = @$this->doc->loadXML($xml_string);
+        libxml_disable_entity_loader($loader);
+        libxml_use_internal_errors($errors);
+
+        if (!$parse_result) {
             return false;
         }

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

10

News mentions

0

No linked articles in our index yet.