CVE-2012-4399

The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.

Published: Oct 10, 2012
Updated: May 9, 2024
CVE: CVE-2012-4399
GHSA: GHSA-5964-pq8r-4q62
Severity: High
Exploit:

CVSS v3:

Severity: High
Score: 7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v2:

Severity: Medium
Score: 5
AV:N/AC:L/Au:N/C:P/I:N/A:N

CWEs:

CWE-611
CWE-264

OWASP TOP 10:

A4 - XML External Entities (XXE)

Affected Software
References

Software	From	Fixed in
cakephp / cakephp	2.1.0-alpha	2.1.5
cakephp / cakephp	2.2.0-beta	2.2.1
cakefoundation / cakephp	2.2.0	2.2.1
cakefoundation / cakephp	2.1.0	2.1.5

http://bakery.cakephp.org/articles/markstory/2012/07/14/security_release_-_cakephp_2_1_5_2_2_1
http://seclists.org/bugtraq/2012/Jul/101
http://secunia.com/advisories/49900
http://www.exploit-db.com/exploits/19863
http://www.openwall.com/lists/oss-security/2012/09/03/1
http://www.openwall.com/lists/oss-security/2012/09/03/2
http://www.osvdb.org/84042

Vulnerability Database

CVE-2012-4399