CVE-2012-3363
- State
- Published
- Severity
- 9.1 Critical
- Published
- Feb 13, 2013
- Updated
- Jan 16, 2025
- Reserved
- Jun 14, 2012
Description
Zend_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not properly handle SimpleXMLElement classes, which allows remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML external entity (XXE) injection attack.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.1 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N | CISA-ADP |
Weaknesses
- CWE-611 Improper Restriction of XML External Entity Reference
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- https://moodle.org/mod/forum/discuss.php?d=225345
- FEDORA-2013-4387vendor-advisory
- [oss-security] 20120627 Re: XXE in Zendmailing-list
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-34284
- DSA-2505vendor-advisory
- [oss-security] 20120626 Re: XXE in Zendmailing-list
- FEDORA-2013-4404vendor-advisory
- [oss-security] 20120626 XXE in Zendmailing-list
- [oss-security] 20130325 Moodle security notifications publicmailing-list
- 1027208vdb-entry
- http://framework.zend.com/security/advisory/ZF2012-01
- https://www.sec-consult.com/files/20120626-0_zend_framework_xxe_injection.txt
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.