GitHub Advisoryadvisory · Packagist

GHSA-9m5v-vq4f-mrvf Zend Framework XXE Vulnerability

MEDIUM Published 2022-05-17 Modified 2024-01-12 Official page ↗
Aliases
CVE-2012-5657
Ecosystem
Packagist
Packages
zendframework/zendframework1
Severity
Moderate
Weaknesses
CWE-200, CWE-611
Reviewed
2024-01-12

Affected packages

• Packagist zendframework/zendframework1: < 1.11.15 → fixed in 1.11.15 • Packagist zendframework/zendframework1: >= 1.12.0-rc1, < 1.12.1 → fixed in 1.12.1

Description

The (1) Zend_Feed_Rss and (2) Zend_Feed_Atom classes in Zend_Feed in Zend Framework 1.11.x before 1.11.15 and 1.12.x before 1.12.1 allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, and possibly cause a denial of service (CPU and memory consumption) via an XML External Entity (XXE) attack.

Related

Alias · CVE (1)

  • CVE-2012-5657 The (1) Zend_Feed_Rss and (2) Zend_Feed_Atom classes in Zend_Feed in Zend Framework 1.11.x before 1.11.15 and 1.12.x before 1.12.1 allow… vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References