Vulnerability Database

289,697

Total vulnerabilities in the database

CVE-2012-3363

Zend_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not properly handle SimpleXMLElement classes, which allows remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML external entity (XXE) injection attack.

  • Published: Feb 13, 2013
  • Updated: May 9, 2024
  • CVE: CVE-2012-3363
  • Severity: Critical
  • Exploit:

CVSS v3:

  • Severity: Critical
  • Score: 9.1
  • AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CVSS v2:

  • Severity: Medium
  • Score: 6.4
  • AV:N/AC:L/Au:N/C:P/I:P/A:N

CWEs:

OWASP TOP 10:

Software From Fixed in
zend / zend_framework 1.12.0-rc3 1.12.0-rc3.x
zend / zend_framework 1.12.0-rc1 1.12.0-rc1.x
zend / zend_framework 1.12.0-rc4 1.12.0-rc4.x
zend / zend_framework 1.12.0-rc2 1.12.0-rc2.x
zend / zend_framework 1.0.0 1.11.12
fedoraproject / fedora 17 17.x
fedoraproject / fedora 18 18.x
debian / debian_linux 6.0 6.0.x