{"api_version":"1","generated_at":"2026-07-24T18:45:55+00:00","cve":"CVE-2013-6244","urls":{"html":"https://cve.report/CVE-2013-6244","api":"https://cve.report/api/cve/CVE-2013-6244.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2013-6244","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2013-6244"},"summary":{"title":"CVE-2013-6244","description":"The Live Update webdynpro application (webdynpro/dispatcher/sap.com/tc~slm~ui_lup/LUP) in SAP NetWeaver 7.31 and earlier allows remote attackers to read arbitrary files and directories via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.","state":"PUBLISHED","assigner":"mitre","published_at":"2013-10-24 00:55:02","updated_at":"2026-04-29 01:13:23"},"problem_types":["NVD-CWE-noinfo","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"}}],"references":[{"url":"http://osvdb.org/98892","name":"http://osvdb.org/98892","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.securityfocus.com/bid/63302","name":"http://www.securityfocus.com/bid/63302","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SAP NetWeaver Web Dynpro Live Update XML External Entity Information Disclosure Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://en.securitylab.ru/lab/PT-2013-13","name":"http://en.securitylab.ru/lab/PT-2013-13","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Vulnerabilities","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"https://service.sap.com/sap/support/notes/1820894","name":"https://service.sap.com/sap/support/notes/1820894","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://scn.sap.com/docs/DOC-8218","name":"http://scn.sap.com/docs/DOC-8218","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Acknowledgments to Security Researchers | SCN","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/55302","name":"http://secunia.com/advisories/55302","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Security Advisory SA55302 - SAP NetWeaver Live Update XML External Entities Information Disclosure Vulnerability - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-6244","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-6244","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2013","cve_id":"6244","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sap","cpe5":"netweaver","cpe6":"4.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"6244","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sap","cpe5":"netweaver","cpe6":"6.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"6244","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sap","cpe5":"netweaver","cpe6":"7.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"6244","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sap","cpe5":"netweaver","cpe6":"7.01","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"6244","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sap","cpe5":"netweaver","cpe6":"7.02","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"6244","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sap","cpe5":"netweaver","cpe6":"7.03","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"6244","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sap","cpe5":"netweaver","cpe6":"7.10","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"6244","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sap","cpe5":"netweaver","cpe6":"7.30","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"6244","vulnerable":"1","versionEndIncluding":"7.31","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sap","cpe5":"netweaver","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T17:38:59.496Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"55302","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/55302"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://en.securitylab.ru/lab/PT-2013-13"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://service.sap.com/sap/support/notes/1820894"},{"name":"98892","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/98892"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://scn.sap.com/docs/DOC-8218"},{"name":"63302","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/63302"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"descriptions":[{"lang":"en","value":"The Live Update webdynpro application (webdynpro/dispatcher/sap.com/tc~slm~ui_lup/LUP) in SAP NetWeaver 7.31 and earlier allows remote attackers to read arbitrary files and directories via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2013-10-24T00:00:00.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"55302","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/55302"},{"tags":["x_refsource_MISC"],"url":"http://en.securitylab.ru/lab/PT-2013-13"},{"tags":["x_refsource_MISC"],"url":"https://service.sap.com/sap/support/notes/1820894"},{"name":"98892","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/98892"},{"tags":["x_refsource_CONFIRM"],"url":"http://scn.sap.com/docs/DOC-8218"},{"name":"63302","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/63302"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2013-6244","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The Live Update webdynpro application (webdynpro/dispatcher/sap.com/tc~slm~ui_lup/LUP) in SAP NetWeaver 7.31 and earlier allows remote attackers to read arbitrary files and directories via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"55302","refsource":"SECUNIA","url":"http://secunia.com/advisories/55302"},{"name":"http://en.securitylab.ru/lab/PT-2013-13","refsource":"MISC","url":"http://en.securitylab.ru/lab/PT-2013-13"},{"name":"https://service.sap.com/sap/support/notes/1820894","refsource":"MISC","url":"https://service.sap.com/sap/support/notes/1820894"},{"name":"98892","refsource":"OSVDB","url":"http://osvdb.org/98892"},{"name":"http://scn.sap.com/docs/DOC-8218","refsource":"CONFIRM","url":"http://scn.sap.com/docs/DOC-8218"},{"name":"63302","refsource":"BID","url":"http://www.securityfocus.com/bid/63302"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2013-6244","datePublished":"2013-10-24T00:00:00.000Z","dateReserved":"2013-10-23T00:00:00.000Z","dateUpdated":"2024-09-17T00:46:59.269Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2013-10-24 00:55:02","lastModifiedDate":"2026-04-29 01:13:23","problem_types":["NVD-CWE-noinfo","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:sap:netweaver:*:*:*:*:*:*:*:*","versionEndIncluding":"7.31","matchCriteriaId":"8AAB3DAC-021F-4C9E-B46E-BD656C1AB629"},{"vulnerable":true,"criteria":"cpe:2.3:a:sap:netweaver:4.0:*:*:*:*:*:*:*","matchCriteriaId":"F59EAE32-F443-490E-9213-596430E406E7"},{"vulnerable":true,"criteria":"cpe:2.3:a:sap:netweaver:6.4:*:*:*:*:*:*:*","matchCriteriaId":"A35F93E3-FC19-4A52-885A-AA2112CAF34D"},{"vulnerable":true,"criteria":"cpe:2.3:a:sap:netweaver:7.0:*:*:*:*:*:*:*","matchCriteriaId":"41FAC5DD-D577-47F9-B0CA-006032256642"},{"vulnerable":true,"criteria":"cpe:2.3:a:sap:netweaver:7.01:*:*:*:*:*:*:*","matchCriteriaId":"2794A7DB-D5B8-467E-93F4-D65245FF187D"},{"vulnerable":true,"criteria":"cpe:2.3:a:sap:netweaver:7.02:*:*:*:*:*:*:*","matchCriteriaId":"A9805246-77E5-456C-B7CF-07CFF2F9F069"},{"vulnerable":true,"criteria":"cpe:2.3:a:sap:netweaver:7.03:*:*:*:*:*:*:*","matchCriteriaId":"369D0212-65DA-4121-981B-1F07B7465F97"},{"vulnerable":true,"criteria":"cpe:2.3:a:sap:netweaver:7.10:*:*:*:*:*:*:*","matchCriteriaId":"EDFFDB95-B956-4B22-81F4-A4074D49D4A8"},{"vulnerable":true,"criteria":"cpe:2.3:a:sap:netweaver:7.30:*:*:*:*:*:*:*","matchCriteriaId":"606EFE4F-57A4-44E2-A98D-F0867A658218"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2013","CveId":"6244","Ordinal":"1","Title":"CVE-2013-6244","CVE":"CVE-2013-6244","Year":"2013"},"notes":[{"CveYear":"2013","CveId":"6244","Ordinal":"1","NoteData":"The Live Update webdynpro application (webdynpro/dispatcher/sap.com/tc~slm~ui_lup/LUP) in SAP NetWeaver 7.31 and earlier allows remote attackers to read arbitrary files and directories via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.","Type":"Description","Title":"CVE-2013-6244"},{"CveYear":"2013","CveId":"6244","Ordinal":"2","NoteData":"2013-10-23","Type":"Other","Title":"Published"}]}}}