CVE-2013-3617: Openbravo ERP

Low severity, CVSS 3.5. EPSS: 21.1% chance of exploitation in the next 30 days.

The XML API in Openbravo ERP 2.5, 3.0, and earlier allows remote authenticated users to read arbitrary files via an XML document with an external entity declaration in conjunction with an entity reference to /ws/dal/ADUser or other /ws/dal/XXX interfaces, related to an XML External Entity (XXE) issue.

Affected products

• Openbravo Openbravo ERP: up to and including 3.0; version 2.40 only; version 2.50 only

Published 2013-11-02. Last modified 2026-06-16.