CVE-2014-2683
published 2014-11-16CVE-2014-2683: Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler…
PriorityP423medium5CVSS 2.0
AVNACLAuNCNINAP
EPSS
2.37%
81.7th percentile
Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0 allow remote attackers to cause a denial of service (CPU consumption) via (1) recursive or (2) circular references in an XML entity definition in an XML DOCTYPE declaration, aka an XML Entity Expansion (XEE) attack. NOTE: this issue exists because of an incomplete fix for CVE-2012-6532.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| zend | zend_framework | < 1.12.4 | 1.12.4 |
| zend | zend_framework | >= 2.1.0 < 2.1.6 | 2.1.6 |
| zend | zend_framework | >= 2.2.0 < 2.2.6 | 2.2.6 |
| zend | zendopenid | <= 2.0.1 | — |
| zend | zendrest | <= 2.0.1 | — |
| zend | zendservice_amazon | <= 2.0.2 | — |
| zend | zendservice_api | <= 1.0.0 | — |
| zend | zendservice_audioscrobbler | <= 2.0.1 | — |
| zend | zendservice_nirvanix | <= 2.0.1 | — |
| zend | zendservice_slideshare | <= 2.0.1 | — |
| zend | zendservice_technorati | <= 2.0.1 | — |
| zend | zendservice_windowsazure | <= 2.0.1 | — |
| zendframework | zendframework1 | >= 0 < 1.12.4 | 1.12.4 |
| zendframework | zendopenid | >= 0 < 2.0.2 | 2.0.2 |
| zendframework | zendrest | >= 0 < 2.0.2 | 2.0.2 |
| zendframework | zendservice-amazon | >= 0 < 2.0.3 | 2.0.3 |
| zendframework | zendservice-api | >= 0 < 1.0.0 | 1.0.0 |
| zendframework | zendservice-audioscrobbler | >= 0 < 2.0.2 | 2.0.2 |
| zendframework | zendservice-nirvanix | >= 0 < 2.0.2 | 2.0.2 |
| zendframework | zendservice-slideshare | >= 0 < 2.0.2 | 2.0.2 |
| zendframework | zendservice-technorati | >= 0 < 2.0.2 | 2.0.2 |
| zendframework | zendservice-windowsazure | >= 0 < 2.0.2 | 2.0.2 |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
ghsa5.0MEDIUM
osv5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Several Zend Products Vulnerable to XXE and XEE attacks
ghsa·2022-05-14·CVSS 5.0
CVE-2014-2683 [MEDIUM] CWE-611 Several Zend Products Vulnerable to XXE and XEE attacks
Several Zend Products Vulnerable to XXE and XEE attacks
Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0 allow remote attackers to cause a denial of service (CPU consumption) via (1) recursive or (2) circular references in an XML entity definition in an XML DOCTYPE declaration, aka an XML Entity Expansion (XEE) attack. NOTE: this issue exists because of an incomplete fix for CVE-2012-6532.
OSV
Several Zend Products Vulnerable to XXE and XEE attacks
osv·2022-05-14·CVSS 5.0
CVE-2014-2683 [MEDIUM] Several Zend Products Vulnerable to XXE and XEE attacks
Several Zend Products Vulnerable to XXE and XEE attacks
Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0 allow remote attackers to cause a denial of service (CPU consumption) via (1) recursive or (2) circular references in an XML entity definition in an XML DOCTYPE declaration, aka an XML Entity Expansion (XEE) attack. NOTE: this issue exists because of an incomplete fix for CVE-2012-6532.
No detection rules found.
No public exploits indexed.
http://advisories.mageia.org/MGASA-2014-0151.htmlhttp://framework.zend.com/security/advisory/ZF2014-01http://seclists.org/oss-sec/2014/q2/0http://www.debian.org/security/2015/dsa-3265http://www.mandriva.com/security/advisories?name=MDVSA-2014:072http://www.securityfocus.com/bid/66358http://advisories.mageia.org/MGASA-2014-0151.htmlhttp://framework.zend.com/security/advisory/ZF2014-01http://seclists.org/oss-sec/2014/q2/0http://www.debian.org/security/2015/dsa-3265http://www.mandriva.com/security/advisories?name=MDVSA-2014:072http://www.securityfocus.com/bid/66358
2014-11-16
Published