CVE-2013-6948

{"id": "CVE-2013-6948", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": true, "impactScore": 6.9, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2014-02-22T21:55:09.203", "references": [{"url": "http://www.ioactive.com/pdfs/IOActive_Belkin-advisory-lite.pdf", "source": "cret@cert.org"}, {"url": "http://www.kb.cert.org/vuls/id/656302", "tags": ["US Government Resource"], "source": "cret@cert.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "The peerAddresses API in the Belkin WeMo Home Automation firmware before 3949 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue."}, {"lang": "es", "value": "La API peerAddresses en la versi\u00f3n de firmware anterior a 3949 de Belkin WeMo Home Automation, permite a los atacantes remotos leer archivos arbitrarios por medio de un documento XML que contiene una declaraci\u00f3n de entidad externa en conjunci\u00f3n con una referencia de entidad, relacionada a un problema de tipo XML External Entity (XXE)."}], "lastModified": "2014-03-06T04:49:56.393", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:belkin:wemo_home_automation_firmware:2769:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "28ACACEF-ADE2-4A54-8F6D-281167EA4A0C"}], "operator": "OR"}]}], "sourceIdentifier": "cret@cert.org"}