Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS03cGc0LTUyMzMtODJqds4AAe3Y
Zend Framework XXE Vulnerability
Zend_XmlRpc
in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not properly handle SimpleXMLElement
classes, which allows remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML external entity (XXE) injection attack.
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03cGc0LTUyMzMtODJqds4AAe3Y
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: almost 2 years ago
Updated: 30 days ago
CVSS Score: 7.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Identifiers: GHSA-7pg4-5233-82jv, CVE-2012-3363
References:
- https://nvd.nist.gov/vuln/detail/CVE-2012-3363
- https://moodle.org/mod/forum/discuss.php?d=225345
- https://www.sec-consult.com/files/20120626-0_zend_framework_xxe_injection.txt
- http://framework.zend.com/security/advisory/ZF2012-01
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-34284
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101310.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101358.html
- http://openwall.com/lists/oss-security/2013/03/25/2
- http://www.debian.org/security/2012/dsa-2505
- http://www.openwall.com/lists/oss-security/2012/06/26/2
- http://www.openwall.com/lists/oss-security/2012/06/26/4
- http://www.openwall.com/lists/oss-security/2012/06/27/2
- https://github.com/zendframework/zf1/commit/281a3251d71ed40a5289ec4afc355eea8e014dc5
- https://web.archive.org/web/20170223044943/http://www.securitytracker.com/id?1027208
- http://www.securitytracker.com/id?1027208
- https://github.com/advisories/GHSA-7pg4-5233-82jv
Blast Radius: 21.4
Affected Packages
packagist:zendframework/zendframework1
Dependent packages: 151Dependent repositories: 841
Downloads: 6,483,517 total
Affected Version Ranges: >= 1.0.0, < 1.11.12, >= 1.12.0-rc1, < 1.12.0
Fixed in: 1.11.12, 1.12.0
All affected versions:
All unaffected versions: 1.12.0, 1.12.1, 1.12.2, 1.12.3, 1.12.4, 1.12.5, 1.12.6, 1.12.7, 1.12.8, 1.12.9, 1.12.10, 1.12.11, 1.12.12, 1.12.13, 1.12.14, 1.12.15, 1.12.16, 1.12.17, 1.12.18, 1.12.19, 1.12.20