Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS0yMjl4LTIyeGMtMmYyd84AA80B

Zendframework Local file disclosure via XXE injection in Zend_XmlRpc

Zend_XmlRpc is vulnerable to XML eXternal Entity (XXE) Injection attacks. The SimpleXMLElement class (SimpleXML PHP extension) is used in an insecure way to parse XML data. External entities can be specified by adding a specific DOCTYPE element to XML-RPC requests. By exploiting this vulnerability an application may be coerced to open arbitrary files and/or TCP connections.

Permalink: https://github.com/advisories/GHSA-229x-22xc-2f2w
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yMjl4LTIyeGMtMmYyd84AA80B
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 3 months ago
Updated: 3 months ago

CVSS Score: 8.6
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Identifiers: GHSA-229x-22xc-2f2w
References:

• https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/ZF2012-01.yaml
• https://web.archive.org/web/20210620092354/https://framework.zend.com/security/advisory/ZF2012-01
• https://github.com/advisories/GHSA-229x-22xc-2f2w

Blast Radius: 25.2

Affected Packages