Vulnerability Details : CVE-2012-3363
Zend_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not properly handle SimpleXMLElement classes, which allows remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML external entity (XXE) injection attack.
Vulnerability category: XML external entity (XXE) injection
Exploit prediction scoring system (EPSS) score for CVE-2012-3363
Probability of exploitation activity in the next 30 days: 52.46%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 97 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2012-3363
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
6.4
|
MEDIUM | AV:N/AC:L/Au:N/C:P/I:P/A:N |
10.0
|
4.9
|
NIST |
9.1
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
3.9
|
5.2
|
NIST |
CWE ids for CVE-2012-3363
-
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.Assigned by: nvd@nist.gov (Primary)
References for CVE-2012-3363
-
http://www.debian.org/security/2012/dsa-2505
Debian -- Security Information -- DSA-2505-1 zendframeworkMailing List
-
http://www.openwall.com/lists/oss-security/2012/06/26/4
oss-security - Re: XXE in ZendMailing List
-
http://www.securitytracker.com/id?1027208
Zend Framework XML Entity Processing Flaw Lets Remote Users View Files - SecurityTrackerBroken Link;Third Party Advisory;VDB Entry
-
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-34284
Official Moodle git projects - moodle.git/searchPatch
-
https://www.sec-consult.com/files/20120626-0_zend_framework_xxe_injection.txt
Page not found | SEC ConsultBroken Link
-
http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101310.html
[SECURITY] Fedora 17 Update: moodle-2.2.9-1.fc17Mailing List
-
http://openwall.com/lists/oss-security/2013/03/25/2
oss-security - Moodle security notifications publicMailing List
-
http://www.openwall.com/lists/oss-security/2012/06/27/2
oss-security - Re: XXE in ZendMailing List
-
http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101358.html
[SECURITY] Fedora 18 Update: moodle-2.3.6-1.fc18Mailing List
-
http://framework.zend.com/security/advisory/ZF2012-01
Security Advisory - Security - Zend FrameworkVendor Advisory
-
https://moodle.org/mod/forum/discuss.php?d=225345
Moodle.org: MSA-13-0016: External Entity Injection through Zend libraryThird Party Advisory
-
http://www.openwall.com/lists/oss-security/2012/06/26/2
oss-security - XXE in ZendMailing List
Products affected by CVE-2012-3363
- cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:*:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.12.0:rc3:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.12.0:rc4:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.12.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.12.0:rc2:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:17:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:18:*:*:*:*:*:*:*