Is CVE-2013-4002 being actively exploited?

CVE-2013-4002 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2013-4002?

CVE-2013-4002 has a CVSS 2.0 base score of 7.1 (HIGH).

CVE-2013-4002

HIGH · CVSS 7.1EPSS 24.7%EU EUVD

XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 as well as Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, Java SE Embedded 7u40 and earlier, and possibly other products allows remote attackers to cause a denial of service via vectors related to XML attribute names.

Key facts

CVSS score: 7.1 (v2.0)
Severity: HIGH
CVSS vector: AV:N/AC:M/Au:N/C:N/I:N/A:C
EPSS score: 24.7% (98th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2022-3018)
Published: July 23, 2013
NVD last modified: June 16, 2026
Status: Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2022-3018 in the EU Vulnerability Database. Last updated in EUVD on August 6, 2024.

View on the EU Vulnerability Database

Affected products

apache / xerces2 java
canonical / ubuntu linux
canonical / ubuntu linux
canonical / ubuntu linux
canonical / ubuntu linux
canonical / ubuntu linux
hp / hp-ux
ibm / aix
ibm / host on-demand
ibm / host on-demand
ibm / host on-demand
ibm / host on-demand
ibm / host on-demand
ibm / host on-demand
ibm / host on-demand
ibm / host on-demand
ibm / host on-demand
ibm / host on-demand
ibm / host on-demand
ibm / i
ibm / java
ibm / java
ibm / java
ibm / java
ibm / java
ibm / java
ibm / java
ibm / java
ibm / java
ibm / java
ibm / java
ibm / java
ibm / java
ibm / java
ibm / java
ibm / java
ibm / java
ibm / java
ibm / java
ibm / java
ibm / java
ibm / java
ibm / java
ibm / java
ibm / java
ibm / java
ibm / java
ibm / java
ibm / java
ibm / java

and 45 more…

Certified products that may be affected

4 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

SUSE Linux Enterprise Server 11 Service Pack 2 on IBM System z - SUSE Linux Products Gmbh - Common Criteria BSI-DSZ-CC-0852-2013 - archived
SUSE Linux Enterprise Server 11 Service Pack 2 including KVM virtualization - SUSE Linux Products Gmbh - Common Criteria BSI-DSZ-CC-0787-2013 - archived
SUSE Linux Enterprise Server Version 9 with Service Pack 2, ProPack 4 for Service Pack 2 and certification-sles-sgi-eal3 package - SUSE Linux Products Gmbh - Common Criteria BSI-DSZ-CC-0292-2005 - archived
SuSE Linux Enterprise Server Version 9 with certification-sles-ibm-eal4 package - SUSE Linux Products Gmbh - Common Criteria BSI-DSZ-CC-0256-2005 - archived

References

http://lists.apple.com/archives/security-announce/2013/Oct/msg00001.html(Broken Link, Mailing List)
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00026.html(Third Party Advisory)
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00027.html(Third Party Advisory)
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00028.html(Third Party Advisory)
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00029.html(Third Party Advisory)
http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00000.html(Third Party Advisory)
http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00003.html(Third Party Advisory)
http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00010.html(Third Party Advisory)
http://lists.opensuse.org/opensuse-updates/2013-11/msg00023.html(Third Party Advisory)
http://marc.info/?l=bugtraq&m=138674031212883&w=2(Issue Tracking, Mailing List, Third Party Advisory)
http://marc.info/?l=bugtraq&m=138674073720143&w=2(Issue Tracking, Mailing List, Third Party Advisory)
http://rhn.redhat.com/errata/RHSA-2013-1059.html(Broken Link)
http://rhn.redhat.com/errata/RHSA-2013-1060.html(Broken Link)
http://rhn.redhat.com/errata/RHSA-2013-1081.html(Broken Link)
http://rhn.redhat.com/errata/RHSA-2013-1440.html(Broken Link)
http://rhn.redhat.com/errata/RHSA-2013-1447.html(Broken Link)
http://rhn.redhat.com/errata/RHSA-2013-1451.html(Broken Link)
http://rhn.redhat.com/errata/RHSA-2013-1505.html(Broken Link)
http://rhn.redhat.com/errata/RHSA-2014-1818.html(Broken Link)
http://rhn.redhat.com/errata/RHSA-2014-1821.html(Broken Link)
http://rhn.redhat.com/errata/RHSA-2014-1822.html(Broken Link)
http://rhn.redhat.com/errata/RHSA-2014-1823.html(Broken Link)
http://rhn.redhat.com/errata/RHSA-2015-0675.html(Broken Link)
http://rhn.redhat.com/errata/RHSA-2015-0720.html(Broken Link)
http://rhn.redhat.com/errata/RHSA-2015-0765.html(Broken Link)
http://rhn.redhat.com/errata/RHSA-2015-0773.html(Broken Link)
http://secunia.com/advisories/56257(Third Party Advisory)
http://security.gentoo.org/glsa/glsa-201406-32.xml(Third Party Advisory)
http://support.apple.com/kb/HT5982(Third Party Advisory)
http://svn.apache.org/viewvc/xerces/java/trunk/src/org/apache/xerces/impl/XMLScanner.java?r1=965250&r2=1499506&view=patch(Patch, Vendor Advisory)
http://www-01.ibm.com/support/docview.wss?uid=swg1IC98015(Vendor Advisory)
http://www-01.ibm.com/support/docview.wss?uid=swg21644197(Vendor Advisory)
http://www-01.ibm.com/support/docview.wss?uid=swg21653371(Vendor Advisory)
http://www-01.ibm.com/support/docview.wss?uid=swg21657539(Vendor Advisory)
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS13-025/index.html(Third Party Advisory)
http://www.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_ibm_filenet_content_manager_and_ibm_content_foundation_xml_4j_denial_of_service_attack_cve_2013_4002(Vendor Advisory)
http://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_July_2013(Vendor Advisory)
http://www.ibm.com/support/docview.wss?uid=swg21648172(Broken Link)
http://www.securityfocus.com/bid/61310(Third Party Advisory, VDB Entry)
http://www.ubuntu.com/usn/USN-2033-1(Third Party Advisory)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain