CVE-2013-4034 json
IBM Cognos Business Intelligence 8.4.1 before IF3, 10.1.0 before IF4, 10.1.1 before IF4, 10.2.0 before IF4, 10.2.1 before IF2, and 10.2.1.1…
published 12y ago modified 4mo ago also EUVD-2013-3965
- cvss
- 4.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 5.6%
- EPSS 5.6% chance of exploitation in 30 days, percentile 92%
- public exploits
- 1
- Exploit-DB
Summary
IBM Cognos Business Intelligence 8.4.1 before IF3, 10.1.0 before IF4, 10.1.1 before IF4, 10.2.0 before IF4, 10.2.1 before IF2, and 10.2.1.1 before IF1 allows remote authenticated users to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Is CVE-2013-4034 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerTimeline
- First public exploit (EDB-38825)
- Published
Exploit prediction
5.56% chance of exploitation in the next 30 days, higher than 92% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- EDB-38825 IBM Cognos Business Intelligence - XML External Entity Information Disclosure remote, 2013-10-11
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:P/I:N/A:N |
Classification
- Weakness
-
- CWE-264 Permissions, Privileges, and Access Controls
References
-
www-01.ibm.com
/support/docview.wss?uid=swg21652590
vendor-advisory
-
exchange.xforce.ibmcloud.com
/vulnerabilities/86137
vdb-entry
Sources
- CVE List CVE-2013-4034
- NVD CVE-2013-4034
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.