What is GHSA-6jvw-rpw4-gj4x?

GHSA-6jvw-rpw4-gj4x is a security advisory published by GitHub Security Advisories with Medium severity. Apache Shindig PHP Sensitive Information Disclosure

Which CVE IDs does GHSA-6jvw-rpw4-gj4x cover?

GHSA-6jvw-rpw4-gj4x covers the following CVE IDs: CVE-2013-4295. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-6jvw-rpw4-gj4x?

GHSA-6jvw-rpw4-gj4x has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

Which products are affected by GHSA-6jvw-rpw4-gj4x?

GHSA-6jvw-rpw4-gj4x affects 1 product, including: maven/org.apache.shindig:shindig-php:\u003e= 2.5.0-beta1, \u003c 2.5.0-update1.

GHSA-6jvw-rpw4-gj4xMediumCVSS 5.3

Apache Shindig PHP Sensitive Information Disclosure

Vendor

GitHub Security Advisories

Published

May 17, 2022

Last Modified

August 29, 2023

🔗 CVE IDs covered (1)

CVE-2013-4295 →

📋 Description

The gadget renderer in Apache Shindig 2.5.0 for PHP allows remote attackers to obtain sensitive information via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

🎯 Affected products1

maven/org.apache.shindig:shindig-php:>= 2.5.0-beta1, < 2.5.0-update1

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2013-4295
http://archives.neohapsis.com/archives/bugtraq/2013-10/0104.html
http://shindig.apache.org/security.html
http://www.securityfocus.com/bid/63260
https://github.com/advisories/GHSA-6jvw-rpw4-gj4x