CVE-2013-0340 describes an XML External Entity (XXE) vulnerability in expat before version 2.4.0, impacting products like Apple and Python. This flaw allows remote attackers to trigger denial of service, send HTTP requests to intranet servers, or read arbitrary files through specially crafted XML documents, unless the XML_SetEntityDeclHandler function is explicitly used by developers. The vulnerability carries a CVSS score of 6.8, indicating a medium attack complexity and potential for partial impact on confidentiality, integrity, and availability. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2.4.0CPE matchmatch criteria | cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:* | ||
>= 3.6.0, < 3.6.15CPE matchmatch criteria | cpe:2.3:a:python:python:*:*:*:*:*:*:*:* | ||
>= 3.7.0, < 3.7.12CPE matchmatch criteria | cpe:2.3:a:python:python:*:*:*:*:*:*:*:* | ||
>= 3.8.0, < 3.8.12CPE matchmatch criteria | cpe:2.3:a:python:python:*:*:*:*:*:*:*:* | ||
>= 3.9.0, < 3.9.7CPE matchmatch criteria | cpe:2.3:a:python:python:*:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:M/Au:N/C:P/I:P/A:P
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function which allows remote attackers to cause a denial of service (resource consumption) send HTTP requests to intranet servers or read arbitrary files via a crafted XML document aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion the responsibility for resolving this issue lies with application developers; according to this argument this entry should be REJECTed and each affected application would need its own CVE.
Jan 2, 2014expat: internal entity expansion
Feb 19, 2013