CVE-2012-6531
published 2013-02-13CVE-2012-6531: (1) Zend_Dom, (2) Zend_Feed, and (3) Zend_Soap in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 do not properly handle SimpleXMLElement classes…
PriorityP337medium6.4CVSS 2.0
AVNACLAuNCPIPAN
EPSS
2.52%
82.9th percentile
(1) Zend_Dom, (2) Zend_Feed, and (3) Zend_Soap in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 do not properly handle SimpleXMLElement classes, which allow remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML external entity (XXE) injection attack, a different vulnerability than CVE-2012-3363.
Affected
58 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| zend | zend_framework | — | — |
| zend | zend_framework | — | — |
| zend | zend_framework | — | — |
| zend | zend_framework | — | — |
| zend | zend_framework | — | — |
| zend | zend_framework | — | — |
| zend | zend_framework | — | — |
| zend | zend_framework | — | — |
| zend | zend_framework | — | — |
| zend | zend_framework | — | — |
| zend | zend_framework | — | — |
| zend | zend_framework | — | — |
| zend | zend_framework | — | — |
| zend | zend_framework | — | — |
| zend | zend_framework | — | — |
| zend | zend_framework | — | — |
| zend | zend_framework | — | — |
| zend | zend_framework | — | — |
| zend | zend_framework | — | — |
| zend | zend_framework | — | — |
| zend | zend_framework | — | — |
| zend | zend_framework | — | — |
| zend | zend_framework | — | — |
| zend | zend_framework | — | — |
| zend | zend_framework | — | — |
CVSS provenance
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N
ghsa9.1CRITICAL
osv9.1CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Zend Framework XEE Vulnerability
ghsa·2022-05-17·CVSS 9.1
CVE-2012-6531 [CRITICAL] CWE-776 Zend Framework XEE Vulnerability
Zend Framework XEE Vulnerability
(1) `Zend_Dom`, (2) `Zend_Feed`, and (3) `Zend_Soap` in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 do not properly handle SimpleXMLElement classes, which allow remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML external entity (XXE) injection attack, a different vulnerability than CVE-2012-3363.
OSV
Zend Framework XEE Vulnerability
osv·2022-05-17·CVSS 9.1
CVE-2012-6531 [CRITICAL] Zend Framework XEE Vulnerability
Zend Framework XEE Vulnerability
(1) `Zend_Dom`, (2) `Zend_Feed`, and (3) `Zend_Soap` in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 do not properly handle SimpleXMLElement classes, which allow remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML external entity (XXE) injection attack, a different vulnerability than CVE-2012-3363.
OSV
CVE-2012-6531: (1) Zend_Dom, (2) Zend_Feed, and (3) Zend_Soap in Zend Framework 1
osv·2013-02-13·CVSS 9.1
CVE-2012-6531 [CRITICAL] CVE-2012-6531: (1) Zend_Dom, (2) Zend_Feed, and (3) Zend_Soap in Zend Framework 1
(1) Zend_Dom, (2) Zend_Feed, and (3) Zend_Soap in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 do not properly handle SimpleXMLElement classes, which allow remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML external entity (XXE) injection attack, a different vulnerability than CVE-2012-3363.
No detection rules found.
No public exploits indexed.
http://framework.zend.com/security/advisory/ZF2012-01http://www.debian.org/security/2012/dsa-2505http://www.openwall.com/lists/oss-security/2012/06/26/2http://www.openwall.com/lists/oss-security/2012/06/26/4http://www.openwall.com/lists/oss-security/2012/06/27/2https://www.sec-consult.com/files/20120626-0_zend_framework_xxe_injection.txthttp://framework.zend.com/security/advisory/ZF2012-01http://www.debian.org/security/2012/dsa-2505http://www.openwall.com/lists/oss-security/2012/06/26/2http://www.openwall.com/lists/oss-security/2012/06/26/4http://www.openwall.com/lists/oss-security/2012/06/27/2https://www.sec-consult.com/files/20120626-0_zend_framework_xxe_injection.txt
2013-02-13
Published