CVE-2013-6244

MediumCVSS 5.0/10Last modified Jun 17, 2026

Description

The Live Update webdynpro application (webdynpro/dispatcher/sap.com/tc~slm~ui_lup/LUP) in SAP NetWeaver 7.31 and earlier allows remote attackers to read arbitrary files and directories via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected software

No affected versions have been published.

Timeline

Published: Oct 24, 2013
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-624510.0Unspecified vulnerability in SAP Sybase Adaptive Server Enterprise (ASE) before 15.0.3 ESD#4.3. 15.5 before 15.5 ESD#5.3, and 15.7 before 15 CVE-2013-62465.0The Dell Quest One Password Manager, possibly 5.0, allows remote attackers to bypass CAPTCHA protections and obtain sensitive information (u CVE-2013-62674.3Multiple cross-site scripting (XSS) vulnerabilities in Claroline before 1.11.9 allow remote attackers to inject arbitrary web script or HTML CVE-2013-62718.8Android 4.0 through 4.3 allows attackers to bypass intended access restrictions and remove device locks via a crafted application that invok CVE-2013-62727.8The NotificationBroadcastReceiver class in the com.android.phone process in Google Android 4.1.1 through 4.4.2 allows attackers to bypass in CVE-2013-62756.5Multiple CSRF issues in Horde Groupware Webmail Edition 5.1.2 and earlier in basic.php.CVE-2013-62769.8QNAP F_VioCard 2312 and F_VioGate 2308 have hardcoded entries in authorized_keys files. NOTE: 1. All active models are not affected. The las CVE-2013-62777.5QNAP VioCard 300 has hardcoded RSA private keys.CVE-2013-62804.3Cross-site scripting (XSS) vulnerability in Social Sharing Toolkit plugin before 2.1.2 for WordPress allows remote attackers to inject arbit CVE-2013-62814.3Cross-site scripting (XSS) vulnerability in codebase/spreadsheet.php in the Spreadsheet (dhtmlxSpreadsheet) plugin 2.0 for WordPress allows CVE-2013-62828.8The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain add CVE-2013-62837.5VideoLAN VLC Media Player 2.0.8 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code