Zend Framework XXE Vulnerability

CRITICAL 9.1CVE-2012-3363 · GHSA-7pg4-5233-82jv · Published 13/02/2013 · updated 16/06/2026

Package	Affected versions	Patched versions
zendframework/zendframework1 Packagist	`≥ 1.0.0, < 1.11.12≥ 1.12.0-rc1, < 1.12.0`	`1.11.121.12.0`
zend framework zend	`= 1.12.0≥ 1.0.0, < 1.11.12`	`1.11.12`

Description

Zend_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not properly handle SimpleXMLElement classes, which allows remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML external entity (XXE) injection attack.

NVD description

Zend_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not properly handle SimpleXMLElement classes, which allows remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML external entity (XXE) injection attack.

References

nvd.nist.gov/vuln/detail/CVE-2012-3363 · ADVISORY
zendframework/zf1 commit 281a325 · WEB
zendframework/zf1 · PACKAGE
moodle.org/mod/forum/discuss.php · WEB
web.archive.org/web/20170223044943/http://www.securitytracker.com/id · WEB
sec-consult.com/files/20120626-0_zend_framework_xxe_injection.txt · WEB
framework.zend.com/security/advisory/ZF2012-01 · WEB
git.moodle.org/gw · WEB
lists.fedoraproject.org/pipermail/package-announce/2013-April/101310.html · WEB
lists.fedoraproject.org/pipermail/package-announce/2013-April/101358.html · WEB
openwall.com/lists/oss-security/2013/03/25/2 · WEB
debian.org/security/2012/dsa-2505 · WEB
openwall.com/lists/oss-security/2012/06/26/2 · WEB
openwall.com/lists/oss-security/2012/06/26/4 · WEB
openwall.com/lists/oss-security/2012/06/27/2 · WEB
securitytracker.com/id · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free