GHSA-7pg4-5233-82jv

Source

https://github.com/advisories/GHSA-7pg4-5233-82jv

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-7pg4-5233-82jv/GHSA-7pg4-5233-82jv.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-7pg4-5233-82jv

Aliases

CVE-2012-3363

Published

2022-05-17T04:56:50Z

Modified

2024-04-09T14:07:57Z

Severity

7.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator

Summary

Zend Framework XXE Vulnerability

Details

Zend_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not properly handle SimpleXMLElement classes, which allows remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML external entity (XXE) injection attack.

Database specific

{
    "nvd_published_at": "2013-02-13T17:55:00Z",
    "cwe_ids": [
        "CWE-611"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-12T18:22:11Z"
}

References

Affected packages

Packagist / zendframework/zendframework1

Package

Name: zendframework/zendframework1
Purl: pkg:composer/zendframework/zendframework1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.0.0

Fixed

1.11.12

Packagist / zendframework/zendframework1

Package

Name: zendframework/zendframework1
Purl: pkg:composer/zendframework/zendframework1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.12.0-rc1

Fixed

1.12.0