Is CVE-2013-0340 being actively exploited?

CVE-2013-0340 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2013-0340?

CVE-2013-0340 has a CVSS 2.0 base score of 6.8 (MEDIUM).

CVE-2013-0340

MEDIUM · CVSS 6.8EPSS 19.4%EU EUVD

expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.

Key facts

CVSS score: 6.8 (v2.0)
Severity: MEDIUM
CVSS vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness (CWE): CWE-611
EPSS score: 19.4% (97th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2013-0352)
Published: January 21, 2014
NVD last modified: October 14, 2026
Status: Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2013-0352 in the EU Vulnerability Database. Last updated in EUVD on October 14, 2026.

View on the EU Vulnerability Database

Affected products

apple / ipados
apple / iphone os
apple / macos
apple / tvos
apple / watchos
libexpat project / libexpat
python / python

Certified products that may be affected

7 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

Strong customer authentication pour Apple Pay sur Apple Watch série 4 exécutant watchOS 7.4.1 (Version 18T201) - Apple Inc. - Common Criteria ANSSI-CC-2023/13 - active
Strong Customer Authentication pour Apple Pay, sur MacBook Air 2020 avec M1 exécutant macOS Big Sur 11.3.1 - Apple Inc. - Common Criteria ANSSI-CC-2022/44 - active
Strong Customer Authentication pour Apple Pay sur iPhone SE (de seconde génération) exécutant iOS 14.5.1 Version 18E212 - Apple Inc. - Common Criteria ANSSI-CC-2022/05 - active
Strong Customer Authentication pour Apple Pay sur iPhone (SoC A12 Bionic) exécutant iOS 14.5.1 Version 18E212 - Apple Inc. - Common Criteria ANSSI-CC-2022/04 - active
Apple macOS 11 Big Sur: Contacts - Apple Inc. - Common Criteria CCEVS-VR-VID-11243-2022 - archived

See all 7 in the Security Certifications Explorer.

References

http://openwall.com/lists/oss-security/2013/02/22/3(Exploit, Mailing List, Third Party Advisory)
http://seclists.org/fulldisclosure/2021/Oct/61(Mailing List, Third Party Advisory)
http://seclists.org/fulldisclosure/2021/Oct/62(Mailing List, Third Party Advisory)
http://seclists.org/fulldisclosure/2021/Oct/63(Mailing List, Third Party Advisory)
http://seclists.org/fulldisclosure/2021/Sep/33(Mailing List, Third Party Advisory)
http://seclists.org/fulldisclosure/2021/Sep/34(Mailing List, Third Party Advisory)
http://seclists.org/fulldisclosure/2021/Sep/35(Mailing List, Third Party Advisory)
http://seclists.org/fulldisclosure/2021/Sep/38(Mailing List, Third Party Advisory)
http://seclists.org/fulldisclosure/2021/Sep/39(Mailing List, Third Party Advisory)
http://seclists.org/fulldisclosure/2021/Sep/40(Mailing List, Third Party Advisory)
http://securitytracker.com/id?1028213(Third Party Advisory, VDB Entry)
http://www.openwall.com/lists/oss-security/2013/04/12/6(Mailing List, Third Party Advisory)
http://www.openwall.com/lists/oss-security/2021/10/07/4(Mailing List, Third Party Advisory)
http://www.osvdb.org/90634(Broken Link)
http://www.securityfocus.com/bid/58233(Broken Link, Third Party Advisory, VDB Entry)
https://cert-portal.siemens.com/productcert/html/ssa-398330.html
https://github.com/libexpat/libexpat/blob/R_2_4_1/expat/Changes
https://lists.apache.org/thread.html/r41eca5f4f09e74436cbb05dec450fc2bef37b5d3e966aa7cc5fada6d%40%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rfb2c193360436e230b85547e85a41bea0916916f96c501f5b6fc4702%40%3Cusers.openoffice.apache.org%3E
https://security.gentoo.org/glsa/201701-21(Third Party Advisory)
https://support.apple.com/kb/HT212804(Third Party Advisory)
https://support.apple.com/kb/HT212805(Third Party Advisory)
https://support.apple.com/kb/HT212807(Third Party Advisory)
https://support.apple.com/kb/HT212814(Third Party Advisory)
https://support.apple.com/kb/HT212815(Third Party Advisory)
https://support.apple.com/kb/HT212819(Third Party Advisory)

Last updated October 15, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain