CVEvulnerability

CVE-2012-3363

9.1 CRITICAL Published 2013-02-13 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2013-02-13
Last modified
2026-06-16
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 2.0 ([email protected])
6.4 MEDIUM — AV:N/AC:L/Au:N/C:P/I:P/A:N
Weaknesses
CWE-611

Description

Zend_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not properly handle SimpleXMLElement classes, which allows remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML external entity (XXE) injection attack.

Affected configurations

• zend zend framework (>= 1.0.0 < 1.11.12) • zend zend framework 1.12.0 • fedoraproject fedora 17 • fedoraproject fedora 18 • debian debian linux 6.0

Related

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

Referenced by CWE · observed example (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References