CVE-2012-6685

CWE-776 — XML Entity Expansion (Billion Laughs)CWE-611 — XML External Entity (XXE)11 documents8 sources
Severity
7.5HIGH
EPSS
0.3%
top 44.64%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Nokogiri NokogiriRedhat Cloudforms Management EngineRedhat Enterprise MRG+3 more
Timeline
PublishedFeb 19
Latest updateApr 23

Description

Nokogiri before 1.5.4 is vulnerable to XXE attacks

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages8 packages

▶RubyGemsnokogiri< 1.5.4
▶NVDnokogiri/nokogiri< 1.5.4
▶Debianruby-nokogiri< 1.5.4-1+3
▶NVDredhat/openstack4.0, 6.0+1

🔴Vulnerability Details

4
OSV
Nokogiri is vulnerable to XML External Entity (XXE) attack↗2022-04-23
▶
GHSA
Nokogiri is vulnerable to XML External Entity (XXE) attack↗2022-04-23
▶
CVEList
CVE-2012-6685: Nokogiri before 1↗2020-02-19
▶
OSV
CVE-2012-6685: Nokogiri before 1↗2020-02-19
▶

📋Vendor Advisories

3
Red Hat
rubygem-nokogiri: XML eXternal Entity (XXE) flaw↗2012-06-06
▶
Debian
CVE-2012-6685: ruby-nokogiri - Nokogiri before 1.5.4 is vulnerable to XXE attacks↗2012
▶
Apple
CVE-2012-6685: Apple TV 7.2.1↗
▶

💬Community

3
Bugzilla
CVE-2012-6685 rubygem-nokogiri: XML eXternal Entity (XXE) flaw [epel-all]↗2015-01-05
▶
Bugzilla
CVE-2012-6685 rubygem-nokogiri: XML eXternal Entity (XXE) flaw↗2015-01-05
▶
Bugzilla
CVE-2012-6685 rubygem-nokogiri: XML eXternal Entity (XXE) flaw [fedora-19]↗2015-01-05
▶