CVE-2012-6531

(1) Zend_Dom, (2) Zend_Feed, and (3) Zend_Soap in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 do not properly handle SimpleXMLElement classes…

published February 13, 2013

CVSS
—
EPSS
3%
Percentile
84.6
In the wild
Unconfirmed
What it is

(1) Zend_Dom, (2) Zend_Feed, and (3) Zend_Soap in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 do not properly handle SimpleXMLElement classes, which allow remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML external entity (XXE) injection attack, a different vulnerability than CVE-2012-3363.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02519 · 84.6th percentile
Published
2013-02-13T17:00Z
EPSS history
Timeline
  • 13 FEB 17:00Z
    (1) Zend_Dom, (2) Zend_Feed, and (3) Zend_Soap in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 do not properly handle SimpleXMLElement classes…
    cvelistv5