PHP OpenID Library vulnerable to XML external entity injection


The PHP OpenID Library contains an XML external entity injection vulnerability.

Takeshi Terada from Mitsui Bussan Secure Directions, Inc. and Kosuke Ebihara reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
CVSS Severity (What is CVSS?)

CVSS V2 Severity:
Base Metrics 6.4 (Medium) [IPA Score]
  • Access Vector: Network
  • Access Complexity: Low
  • Authentication: None
  • Confidentiality Impact: Partial
  • Integrity Impact: None
  • Availability Impact: Partial
Affected Products

  • PHP OpenID Library versions 2.2.2 and earlier


When processing specially crafted XRDS data, information on the server may be disclosed or server resources may be consumed excessively.

[Apply a Patch]
The source code in the repository has been fixed. Please apply the fixed code according to the code committed by the developer.
Vendor Information

CWE (What is CWE?)

  1. No Mapping(CWE-Other) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2013-4701

  1. JVN : JVN#24713981
  2. National Vulnerability Database (NVD) : CVE-2013-4701
Revision History

  • [2013/08/21]
      Web page was published
      References : Content was added