Zend Framework XXE Vulnerability

緊急 9.1CVE-2012-3363 · GHSA-7pg4-5233-82jv · 13/02/2013 公開 · 16/06/2026 更新

パッケージ	影響を受けるバージョン	修正済みバージョン
zendframework/zendframework1 Packagist	`≥ 1.0.0, < 1.11.12≥ 1.12.0-rc1, < 1.12.0`	`1.11.121.12.0`
zend framework zend	`= 1.12.0≥ 1.0.0, < 1.11.12`	`1.11.12`

概要

Zend_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not properly handle SimpleXMLElement classes, which allows remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML external entity (XXE) injection attack.

NVD の説明

Zend_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not properly handle SimpleXMLElement classes, which allows remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML external entity (XXE) injection attack.

参考情報

nvd.nist.gov/vuln/detail/CVE-2012-3363 · ADVISORY
zendframework/zf1 commit 281a325 · WEB
zendframework/zf1 · PACKAGE
moodle.org/mod/forum/discuss.php · WEB
web.archive.org/web/20170223044943/http://www.securitytracker.com/id · WEB
sec-consult.com/files/20120626-0_zend_framework_xxe_injection.txt · WEB
framework.zend.com/security/advisory/ZF2012-01 · WEB
git.moodle.org/gw · WEB
lists.fedoraproject.org/pipermail/package-announce/2013-April/101310.html · WEB
lists.fedoraproject.org/pipermail/package-announce/2013-April/101358.html · WEB
openwall.com/lists/oss-security/2013/03/25/2 · WEB
debian.org/security/2012/dsa-2505 · WEB
openwall.com/lists/oss-security/2012/06/26/2 · WEB
openwall.com/lists/oss-security/2012/06/26/4 · WEB
openwall.com/lists/oss-security/2012/06/27/2 · WEB
securitytracker.com/id · WEB

これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。

無料でサイトをスキャン