Zend Framework XXE Vulnerability

NGHIÊM TRỌNG 9.1CVE-2012-3363 · GHSA-7pg4-5233-82jv · Công bố 13/02/2013 · cập nhật 16/06/2026

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
zendframework/zendframework1 Packagist	`≥ 1.0.0, < 1.11.12≥ 1.12.0-rc1, < 1.12.0`	`1.11.121.12.0`
zend framework zend	`= 1.12.0≥ 1.0.0, < 1.11.12`	`1.11.12`

Mô tả

Zend_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not properly handle SimpleXMLElement classes, which allows remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML external entity (XXE) injection attack.

Mô tả của NVD

Zend_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not properly handle SimpleXMLElement classes, which allows remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML external entity (XXE) injection attack.

Tham khảo

nvd.nist.gov/vuln/detail/CVE-2012-3363 · ADVISORY
zendframework/zf1 commit 281a325 · WEB
zendframework/zf1 · PACKAGE
moodle.org/mod/forum/discuss.php · WEB
web.archive.org/web/20170223044943/http://www.securitytracker.com/id · WEB
sec-consult.com/files/20120626-0_zend_framework_xxe_injection.txt · WEB
framework.zend.com/security/advisory/ZF2012-01 · WEB
git.moodle.org/gw · WEB
lists.fedoraproject.org/pipermail/package-announce/2013-April/101310.html · WEB
lists.fedoraproject.org/pipermail/package-announce/2013-April/101358.html · WEB
openwall.com/lists/oss-security/2013/03/25/2 · WEB
debian.org/security/2012/dsa-2505 · WEB
openwall.com/lists/oss-security/2012/06/26/2 · WEB
openwall.com/lists/oss-security/2012/06/26/4 · WEB
openwall.com/lists/oss-security/2012/06/27/2 · WEB
securitytracker.com/id · WEB

Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.

Quét site miễn phí