GitHub Advisoryadvisory · Packagist

GHSA-7pg4-5233-82jv Zend Framework XXE Vulnerability

HIGH Published 2022-05-17 Modified 2024-04-09 Official page ↗
Aliases
CVE-2012-3363
Ecosystem
Packagist
Packages
zendframework/zendframework1
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-611
Reviewed
2024-01-12

Affected packages

• Packagist zendframework/zendframework1: >= 1.0.0, < 1.11.12 → fixed in 1.11.12 • Packagist zendframework/zendframework1: >= 1.12.0-rc1, < 1.12.0 → fixed in 1.12.0

Description

`Zend_XmlRpc` in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not properly handle `SimpleXMLElement` classes, which allows remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML external entity (XXE) injection attack.

Related

Alias · CVE (1)

  • CVE-2012-3363 Zend_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not properly handle SimpleXMLElement classes, which allows… vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References