Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2012-3363

Zend_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not properly handle SimpleXMLElement classes, which allows remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML external entity (XXE) injection attack.

Published

2013-02-13T17:55:01.320

Last Modified

2025-04-11T00:51:21.963

Status

Deferred

Source

[email protected]

Severity

CVSSv3.1: 9.1 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: NONE
Exploitability Score

10.0

Impact Score

4.9

Weaknesses
  • Type: Primary
    CWE-611
  • Type: Secondary
    CWE-611
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application zend zend_framework < 1.11.12 Yes
Application zend zend_framework 1.12.0 Yes
Application zend zend_framework 1.12.0 Yes
Application zend zend_framework 1.12.0 Yes
Application zend zend_framework 1.12.0 Yes
Operating System fedoraproject fedora 17 Yes
Operating System fedoraproject fedora 18 Yes
Operating System debian debian_linux 6.0 Yes
References