GitHub Advisoryadvisory · Packagist

GHSA-h5p3-7mg6-hgj4 Zend Framework XEE Vulnerability

MEDIUM Published 2022-05-17 Modified 2024-01-12 Official page ↗
Aliases
CVE-2012-6531
Ecosystem
Packagist
Packages
zendframework/zendframework1
Severity
Moderate
Weaknesses
CWE-776
Reviewed
2024-01-12

Affected packages

• Packagist zendframework/zendframework1: >= 1.0, < 1.11.13 → fixed in 1.11.13 • Packagist zendframework/zendframework1: >= 1.12.0-rc1, < 1.12.0 → fixed in 1.12.0

Description

(1) `Zend_Dom`, (2) `Zend_Feed`, and (3) `Zend_Soap` in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 do not properly handle SimpleXMLElement classes, which allow remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML external entity (XXE) injection attack, a different vulnerability than CVE-2012-3363.

Related

Alias · CVE (1)

  • CVE-2012-6531 (1) Zend_Dom, (2) Zend_Feed, and (3) Zend_Soap in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 do not properly handle… vulnerability

Weakness · CWE (1)

  • CWE-776 Improper Restriction of Recursive Entity References in DTDs weakness

References