CVEvulnerability
CVE-2012-4399
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2012-10-09
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-611
Description
The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.
Affected configurations
• cakefoundation cakephp (>= 2.1.0 < 2.1.5)
• cakefoundation cakephp (>= 2.2.0 < 2.2.1)
Related
Weakness · CWE (1)
- CWE-611 Improper Restriction of XML External Entity Reference weakness
Referenced by CWE · observed example (1)
- CWE-611 Improper Restriction of XML External Entity Reference weakness
References
- http://bakery.cakephp.org/articles/markstory/2012/07/14/security_release_-_cakephp_2_1_5_2_2_1 Broken Link, Vendor Advisory
- http://seclists.org/bugtraq/2012/Jul/101 Exploit, Mailing List, Third Party Advisory
- http://secunia.com/advisories/49900 Broken Link, Vendor Advisory
- http://www.exploit-db.com/exploits/19863 Exploit, Third Party Advisory, VDB Entry
- http://www.openwall.com/lists/oss-security/2012/09/03/1 Mailing List
- http://www.openwall.com/lists/oss-security/2012/09/03/2 Mailing List
- http://www.osvdb.org/84042 Broken Link
- http://bakery.cakephp.org/articles/markstory/2012/07/14/security_release_-_cakephp_2_1_5_2_2_1 Broken Link, Vendor Advisory
- http://seclists.org/bugtraq/2012/Jul/101 Exploit, Mailing List, Third Party Advisory
- http://secunia.com/advisories/49900 Broken Link, Vendor Advisory
- http://www.exploit-db.com/exploits/19863 Exploit, Third Party Advisory, VDB Entry
- http://www.openwall.com/lists/oss-security/2012/09/03/1 Mailing List
- http://www.openwall.com/lists/oss-security/2012/09/03/2 Mailing List
- http://www.osvdb.org/84042 Broken Link