CVE-2009-5135

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 9.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2013-05-02 · updated 2026-06-16
Weakness: CWE-20

Description

The Java XML parser in Echo before 2.1.1 and 3.x before 3.0.b6 allows remote attackers to read arbitrary files via a request containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Affected products

Nextapp Echo: through 2.1.0; 2.0-alpha1, 2.0-alpha10, 2.0-alpha11, 2.0-alpha12, 2.0-alpha13, 2.0-alpha14 (+38)

References

http://echo.nextapp.com/site/node/5742
http://secunia.com/advisories/34218
http://www.exploit-db.com/exploits/8191/
http://www.securityfocus.com/archive/1/501637/100/0/threaded
http://www.vupen.com/english/advisories/2009/0653
https://exchange.xforce.ibmcloud.com/vulnerabilities/49167
https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20090305-0_echo_nextapp_xml_injection.txt
http://echo.nextapp.com/site/node/5742
http://secunia.com/advisories/34218
http://www.exploit-db.com/exploits/8191/
http://www.securityfocus.com/archive/1/501637/100/0/threaded
http://www.vupen.com/english/advisories/2009/0653

Get alerted when CVE-2009-5135 or the next vulnerability affects your stack