CVE-2013-4701: Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote attackers to read arbitrary files,...

Security readout for executives and security teams

CVE-2013-4701 is an XXE flaw in PHP OpenID Library 2.2.2 and earlier. If an application processes hostile XRDS discovery data, an attacker may read server files, make the server contact internal systems, or exhaust CPU and memory. Exposure is most likely in legacy PHP applications using PHP OpenID Library 2.2.2 or earlier for OpenID/Yadis discovery, especially where XRDS data can come from remote or user-influenced identity providers. Prioritize remediation where legacy OpenID is internet-facing or tied to sensitive systems. Business risk is highest for file disclosure and server-side access to internal services. If the library is absent or unused, urgency drops substantially. Mitigation focus: Inventory applications using PHP OpenID Library or packaged php-openid dependencies.; Upgrade to a vendor-fixed package or version containing the referenced upstream fix.; Review JVN and openSUSE advisories for distro-specific fixed packages..

Prepared

Jun 14, 2026, 21:50 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.