Read the docs
TI-2013-05393 Aliases CVE-2013-6440GHSA-v723-58jv-2qc4

The (1) BasicParserPool, (2) StaticBasicParserPool, (3) XML Decrypter, and (4) SAML…

Priority LOW 28CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Partial · None · None
Fix status
Partial Red Hat: 12 fixed, 3 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.

Summary

The (1) BasicParserPool, (2) StaticBasicParserPool, (3) XML Decrypter, and (4) SAML Decrypter in Shibboleth OpenSAML-Java before 2.6.1 set the expandEntityReferences property to true, which allows remote attackers to conduct XML external entity (XXE) attacks via a crafted XML DOCTYPE declaration.

Why it matters now

EPSS 0.02752 86th percentileScored 2026-11-07
Fix Partial org.opensaml:opensaml (Maven): 2.6.1Red Hat: 8 advisoriesRed Hat: 12 fixed, 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.opensaml:opensaml (Maven)before 2.6.12.6.1Patch availableGHSA-v723-58jv-2qc4
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.opensaml:opensaml (Maven) Vendor— Affected before 2.6.1 Fixed in 2.6.1 Patch available GHSA-v723-58jv-2qc4

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:internet2:opensaml:2.0:*:*:*:*:*:*:*2.0VulnerableInternet2
cpe:2.3:a:internet2:opensaml:2.1.0:*:*:*:*:*:*:*2.1.0VulnerableInternet2
cpe:2.3:a:internet2:opensaml:2.2.0:*:*:*:*:*:*:*2.2.0VulnerableInternet2
cpe:2.3:a:shibboleth:opensaml:*:*:*:*:*:*:*:*up to 2.6.0VulnerableShibboleth
cpe:2.3:a:shibboleth:opensaml:2.4.0:*:*:*:*:*:*:*2.4.0VulnerableShibboleth
cpe:2.3:a:shibboleth:opensaml:2.4.1:*:*:*:*:*:*:*2.4.1VulnerableShibboleth
cpe:2.3:a:shibboleth:opensaml:2.4.2:*:*:*:*:*:*:*2.4.2VulnerableShibboleth
cpe:2.3:a:shibboleth:opensaml:2.4.3:*:*:*:*:*:*:*2.4.3VulnerableShibboleth
cpe:2.3:a:shibboleth:opensaml:2.5.0:*:*:*:*:*:*:*2.5.0VulnerableShibboleth
cpe:2.3:a:shibboleth:opensaml:2.5.1:*:*:*:*:*:*:*2.5.1VulnerableShibboleth
  • cpe:2.3:a:internet2:opensaml:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Internet2
  • cpe:2.3:a:internet2:opensaml:2.1.0:*:*:*:*:*:*:* Versions 2.1.0 Vulnerable ·Internet2
  • cpe:2.3:a:internet2:opensaml:2.2.0:*:*:*:*:*:*:* Versions 2.2.0 Vulnerable ·Internet2
  • cpe:2.3:a:shibboleth:opensaml:*:*:*:*:*:*:*:* Versions up to 2.6.0 Vulnerable ·Shibboleth
  • cpe:2.3:a:shibboleth:opensaml:2.4.0:*:*:*:*:*:*:* Versions 2.4.0 Vulnerable ·Shibboleth
  • cpe:2.3:a:shibboleth:opensaml:2.4.1:*:*:*:*:*:*:* Versions 2.4.1 Vulnerable ·Shibboleth
  • cpe:2.3:a:shibboleth:opensaml:2.4.2:*:*:*:*:*:*:* Versions 2.4.2 Vulnerable ·Shibboleth
  • cpe:2.3:a:shibboleth:opensaml:2.4.3:*:*:*:*:*:*:* Versions 2.4.3 Vulnerable ·Shibboleth
  • cpe:2.3:a:shibboleth:opensaml:2.5.0:*:*:*:*:*:*:* Versions 2.5.0 Vulnerable ·Shibboleth
  • cpe:2.3:a:shibboleth:opensaml:2.5.1:*:*:*:*:*:*:* Versions 2.5.1 Vulnerable ·Shibboleth
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:shibboleth:opensaml:2.5.2:*:*:*:*:*:*:*2.5.2VulnerableShibboleth
cpe:2.3:a:shibboleth:opensaml:2.5.3:*:*:*:*:*:*:*2.5.3VulnerableShibboleth
  • cpe:2.3:a:shibboleth:opensaml:2.5.2:*:*:*:*:*:*:* Versions 2.5.2 Vulnerable ·Shibboleth
  • cpe:2.3:a:shibboleth:opensaml:2.5.3:*:*:*:*:*:*:* Versions 2.5.3 Vulnerable ·Shibboleth

Remediation

  • Fix · GHSA-v723-58jv-2qc4 org.opensaml:opensaml (Maven) Fixed in 2.6.1 Advisory →

Red Hat 8 advisories

  • RHSA-2014:1995 Released 2014-12-15 · Red Hat rating Important
    Red Hat JBoss Fuse Service Works 6.0.0 security update
    • Red Hat JBoss Fuse Service Works 6.0
  • RHSA-2014:1290 Released 2014-09-23 · Red Hat rating Important
    Red Hat JBoss BRMS 6.0.3 update
    • Red Hat JBoss BRMS 6.0
  • RHSA-2014:1291 Released 2014-09-23 · Red Hat rating Important
    Red Hat JBoss BPM Suite 6.0.3 update
    • Red Hat JBoss BPMS 6.0
Show 5 more Red Hat advisories
  • RHSA-2014:0452 Released 2014-04-30 · Red Hat rating Important
    Fuse ESB Enterprise/Fuse MQ Enterprise 7.1.0 update
    • Fuse ESB Enterprise 7.1.0
    • Fuse MQ Enterprise 7.1.0
    • Fuse Management Console 7.1.0
  • RHSA-2014:0195 Released 2014-02-20 · Red Hat rating Moderate
    Red Hat JBoss Portal 6.1.1 update
    • Red Hat JBoss Portal Platform 6.1
  • RHSA-2014:0170 Released 2014-02-13 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 6.2.1 update
    • Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 Server hornetq-2.3.14-1.Final_redhat_1.1.ep6.el5, jacorb-jboss-2.3.2-13.redhat_6.1.ep6.el5, jboss-as-appclient-7.3.1-3.Final_redhat_3.1.ep6.el5 +47
    • Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 5 Server jbossas-javadocs-7.3.1-3.Final_redhat_3.ep6.el5
  • RHSA-2014:0171 Released 2014-02-13 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 6.2.1 update
    • Red Hat JBoss Enterprise Application Platform 6 for RHEL 6 Server hornetq-2.3.14-1.Final_redhat_1.1.ep6.el6, jacorb-jboss-2.3.2-13.redhat_6.1.ep6.el6, jboss-as-appclient-7.3.1-3.Final_redhat_3.1.ep6.el6 +47
    • Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 6 Server jbossas-javadocs-7.3.1-3.Final_redhat_3.ep6.el6
  • RHSA-2014:0172 Released 2014-02-13 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 6.2.1 update
    • Red Hat JBoss Enterprise Application Platform 6.2

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Enterprise Application Platform 5AffectedNo fix planned: Will not fix
Red Hat JBoss Portal 5AffectedNo fix planned: Will not fix
Red Hat JBoss Portal 6AffectedNo fix yet
Fuse ESB Enterprise 7.1.0Fixed RHSA-2014:0452
Fuse MQ Enterprise 7.1.0Fixed RHSA-2014:0452
Fuse Management Console 7.1.0Fixed RHSA-2014:0452
Red Hat JBoss BPMS 6.0Fixed RHSA-2014:1291
Red Hat JBoss BRMS 6.0Fixed RHSA-2014:1290
Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 ServerFixed RHSA-2014:0170
Red Hat JBoss Enterprise Application Platform 6 for RHEL 6 ServerFixed RHSA-2014:0171
Red Hat JBoss Enterprise Application Platform 6.2Fixed RHSA-2014:0172
Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 5 ServerFixed RHSA-2014:0170
Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 6 ServerFixed RHSA-2014:0171
Red Hat JBoss Fuse Service Works 6.0Fixed RHSA-2014:1995
Red Hat JBoss Portal Platform 6.1Fixed RHSA-2014:0195
Not affected: 2 products
  • Red Hat JBoss Data Virtualization 6
  • Red Hat JBoss Operations Network 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-6440
  2. 2026-10-03 Alias added: GHSA-v723-58jv-2qc4

References

Advisory 5

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences