CVE-2013-5372
published 2013-10-19CVE-2013-5372: The XML4J parser in IBM WebSphere Message Broker 6.1 before 6.1.0.12, 7.0 before 7.0.0.7, and 8.0 before 8.0.0.4 and IBM Integration Bus 9.0 before 9.0.0.1…
PriorityP422medium4.3CVSS 2.0
AVNACMAuNCNINAP
EPSS
2.81%
84.9th percentile
The XML4J parser in IBM WebSphere Message Broker 6.1 before 6.1.0.12, 7.0 before 7.0.0.7, and 8.0 before 8.0.0.4 and IBM Integration Bus 9.0 before 9.0.0.1 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document that triggers expansion for many entities.
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | websphere_message_broker | — | — |
| ibm | websphere_message_broker | — | — |
| ibm | websphere_message_broker | — | — |
| ibm | websphere_message_broker | — | — |
| ibm | websphere_message_broker | — | — |
| ibm | websphere_message_broker | — | — |
| ibm | websphere_message_broker | — | — |
| ibm | websphere_message_broker | — | — |
| ibm | websphere_message_broker | — | — |
| ibm | websphere_message_broker | — | — |
| ibm | websphere_message_broker | — | — |
| ibm | websphere_message_broker | — | — |
| ibm | websphere_message_broker | — | — |
| ibm | websphere_message_broker | — | — |
| ibm | websphere_message_broker | — | — |
| ibm | websphere_message_broker | — | — |
| ibm | websphere_message_broker | — | — |
| ibm | websphere_message_broker | — | — |
| ibm | websphere_message_broker | — | — |
| ibm | websphere_message_broker | — | — |
| ibm | websphere_message_broker | — | — |
| ibm | websphere_message_broker | — | — |
| ibm | websphere_message_broker | — | — |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-fq7g-96mj-hhf9: The XML4J parser in IBM WebSphere Message Broker 6
ghsa_unreviewed·2022-05-17
CVE-2013-5372 [MEDIUM] GHSA-fq7g-96mj-hhf9: The XML4J parser in IBM WebSphere Message Broker 6
The XML4J parser in IBM WebSphere Message Broker 6.1 before 6.1.0.12, 7.0 before 7.0.0.7, and 8.0 before 8.0.0.4 and IBM Integration Bus 9.0 before 9.0.0.1 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document that triggers expansion for many entities.
Red Hat
JDK: XML4J xml entity expansion excessive memory use (XML)
vendor_redhat·2013-11-05·CVSS 4.3
CVE-2013-5372 [MEDIUM] JDK: XML4J xml entity expansion excessive memory use (XML)
JDK: XML4J xml entity expansion excessive memory use (XML)
The XML4J parser in IBM WebSphere Message Broker 6.1 before 6.1.0.12, 7.0 before 7.0.0.7, and 8.0 before 8.0.0.4 and IBM Integration Bus 9.0 before 9.0.0.1 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document that triggers expansion for many entities.
No detection rules found.
No public exploits indexed.
http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00013.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1507.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1508.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1509.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1793.htmlhttp://secunia.com/advisories/56338http://www-01.ibm.com/support/docview.wss?uid=swg1IC96473http://www-01.ibm.com/support/docview.wss?uid=swg21653087http://www-01.ibm.com/support/docview.wss?uid=swg21655201http://www-01.ibm.com/support/docview.wss?uid=swg21655202https://exchange.xforce.ibmcloud.com/vulnerabilities/86662https://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_November_2013http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00013.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1507.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1508.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1509.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1793.htmlhttp://secunia.com/advisories/56338http://www-01.ibm.com/support/docview.wss?uid=swg1IC96473http://www-01.ibm.com/support/docview.wss?uid=swg21653087http://www-01.ibm.com/support/docview.wss?uid=swg21655201http://www-01.ibm.com/support/docview.wss?uid=swg21655202https://exchange.xforce.ibmcloud.com/vulnerabilities/86662https://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_November_2013
2013-10-19
Published