CVE-2013-4295: Exposure of Sensitive Information to an Unauthorized Actor

May 17, 2022 (updated August 29, 2023)

The gadget renderer in Apache Shindig 2.5.0 for PHP allows remote attackers to obtain sensitive information via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

References

archives.neohapsis.com/archives/bugtraq/2013-10/0104.html
shindig.apache.org/security.html
www.securityfocus.com/bid/63260
github.com/advisories/GHSA-6jvw-rpw4-gj4x
nvd.nist.gov/vuln/detail/CVE-2013-4295

Detect and mitigate CVE-2013-4295 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →