UpHeron
All vulnerabilities

Servers and applications

CVE-2013-0340

expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that…

Severity
Medium 6.8
Published
21 Jan 2014
Last changed
14 Oct 2026
Added to UpHeron
21 Oct 2026
Fixed in
3.6.15, 3.7.12, 3.8.12, 3.9.7
Sources
NVD

Affected software

SoftwareAffected versions
PythonServers and applications · cpe:a:python:python
  • From 3.6.0 before 3.6.15
  • From 3.7.0 before 3.7.12
  • From 3.8.0 before 3.8.12
  • From 3.9.0 before 3.9.7

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2013-0340
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2013-0340