« Back to list

CVE-2013-2153

Status: ModifiedMedium (4.3)—

The XML digital signature functionality (xsec/dsig/DSIGReference.cpp) in Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.1 allows context-dependent attackers to reuse signatures and spoof arbitrary content via crafted Reference elements in the Signature, aka "XML Signature Bypass issue."

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Apache — XML Security FOR C++

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2013-2153",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2013-08-20T22:55:03.737",
  "references": [
    {
      "url": "http://archives.neohapsis.com/archives/fulldisclosure/2013-06/0140.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://santuario.apache.org/secadv.data/CVE-2013-2153.txt",
      "tags": [
        "Exploit"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://svn.apache.org/viewvc/santuario/xml-security-cpp/trunk/xsec/dsig/DSIGReference.cpp?r1=1125514&r2=1493959&pathrev=1493959&diff_format=h",
      "tags": [
        "Patch"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.debian.org/security/2013/dsa-2710",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://lists.apache.org/thread.html/680e6938b6412e26d5446054fd31de2011d33af11786b989127d1cc3%40%3Ccommits.santuario.apache.org%3E",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://lists.apache.org/thread.html/r1c07a561426ec5579073046ad7f4207cdcef452bb3100abaf908e0cd%40%3Ccommits.santuario.apache.org%3E",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://www.tenable.com/security/tns-2018-15",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://archives.neohapsis.com/archives/fulldisclosure/2013-06/0140.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://santuario.apache.org/secadv.data/CVE-2013-2153.txt",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://svn.apache.org/viewvc/santuario/xml-security-cpp/trunk/xsec/dsig/DSIGReference.cpp?r1=1125514&r2=1493959&pathrev=1493959&diff_format=h",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.debian.org/security/2013/dsa-2710",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.apache.org/thread.html/680e6938b6412e26d5446054fd31de2011d33af11786b989127d1cc3%40%3Ccommits.santuario.apache.org%3E",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.apache.org/thread.html/r1c07a561426ec5579073046ad7f4207cdcef452bb3100abaf908e0cd%40%3Ccommits.santuario.apache.org%3E",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.tenable.com/security/tns-2018-15",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-310"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The XML digital signature functionality (xsec/dsig/DSIGReference.cpp) in Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.1 allows context-dependent attackers to reuse signatures and spoof arbitrary content via crafted Reference elements in the Signature, aka \"XML Signature Bypass issue.\""
    },
    {
      "lang": "es",
      "value": "La funcionalidad de firma digital XML (xsec/dsig/DSIGReference.cpp)  en Apache Santuario XML Security para C++ (aka xml-security-c) anterior a 1.7.1, permite a atacantes dependientes del contexto reutilizar firmas y suplantar contenido arbitrario a través de elementos Reference manipulados en la firma. Aka \"XML Signature Bypass issue.\""
    }
  ],
  "lastModified": "2026-06-16T23:52:50.733",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:xml_security_for_c\\+\\+:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C6E08B80-1BD6-4EC2-93DF-AEAA536EDE0F",
              "versionEndIncluding": "1.7.0"
            },
            {
              "criteria": "cpe:2.3:a:apache:xml_security_for_c\\+\\+:0.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CFD5684C-5B70-4CD3-89E7-0F3097958AAA"
            },
            {
              "criteria": "cpe:2.3:a:apache:xml_security_for_c\\+\\+:0.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ED43C71F-52EF-4689-B318-58F61A851BA3"
            },
            {
              "criteria": "cpe:2.3:a:apache:xml_security_for_c\\+\\+:1.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CEDB2652-EAAB-43B6-B696-3F959BA8FF44"
            },
            {
              "criteria": "cpe:2.3:a:apache:xml_security_for_c\\+\\+:1.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D49CBC6A-9D55-4DD0-B8DE-EA180ECDC65E"
            },
            {
              "criteria": "cpe:2.3:a:apache:xml_security_for_c\\+\\+:1.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9261A27B-0AAE-4E04-B86A-6580A5AF2338"
            },
            {
              "criteria": "cpe:2.3:a:apache:xml_security_for_c\\+\\+:1.3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "52CA39D1-4388-4D32-9731-A77A398AC7CF"
            },
            {
              "criteria": "cpe:2.3:a:apache:xml_security_for_c\\+\\+:1.3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "121C098C-89AF-4BC2-976B-A4D6A67834DD"
            },
            {
              "criteria": "cpe:2.3:a:apache:xml_security_for_c\\+\\+:1.4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9C786580-77FE-4E7E-AA2E-39B976CD8C01"
            },
            {
              "criteria": "cpe:2.3:a:apache:xml_security_for_c\\+\\+:1.5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5BAC98AB-3D00-43C3-9DF1-39857DFD3A2A"
            },
            {
              "criteria": "cpe:2.3:a:apache:xml_security_for_c\\+\\+:1.5.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "84C316AD-4D17-4286-9A63-300D04CD276B"
            },
            {
              "criteria": "cpe:2.3:a:apache:xml_security_for_c\\+\\+:1.6.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7D0DC1ED-A147-44FA-9A4D-364B98921C35"
            },
            {
              "criteria": "cpe:2.3:a:apache:xml_security_for_c\\+\\+:1.6.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5B2CEC20-1F70-4D95-8972-3163720BCC20"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}