GitHub Advisoryadvisory · Packagist

GHSA-5964-pq8r-4q62 CakePHPallows remote attackers to read arbitrary files via XML data containing external entity references

HIGH Published 2022-05-17 Modified 2024-04-09 Official page ↗
Aliases
CVE-2012-4399
Ecosystem
Packagist
Packages
cakephp/cakephp
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-611
Reviewed
2023-01-14

Affected packages

• Packagist cakephp/cakephp: >= 2.1.0-alpha, < 2.1.5 → fixed in 2.1.5 • Packagist cakephp/cakephp: >= 2.2.0-beta, < 2.2.1 → fixed in 2.2.1

Description

The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.

Related

Alias · CVE (1)

  • CVE-2012-4399 The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing… vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References