CVE-2013-4034

Severity: medium (CVSS 4.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2013-11-18 · updated 2026-06-16
Weakness: CWE-264

Description

IBM Cognos Business Intelligence 8.4.1 before IF3, 10.1.0 before IF4, 10.1.1 before IF4, 10.2.0 before IF4, 10.2.1 before IF2, and 10.2.1.1 before IF1 allows remote authenticated users to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Affected products

IBM Cognos Business Intelligence: 8.4.1, 10.1, 10.1.1, 10.2, 10.2.1, 10.2.1.1

References

http://www-01.ibm.com/support/docview.wss?uid=swg21652590
https://exchange.xforce.ibmcloud.com/vulnerabilities/86137
http://www-01.ibm.com/support/docview.wss?uid=swg21652590
https://exchange.xforce.ibmcloud.com/vulnerabilities/86137

Get alerted when CVE-2013-4034 or the next vulnerability affects your stack