PT-2013-1828 · Zend · Zend Framework

Yury Dyachenko · Publicado 2013-05-02 · Atualizado 2022-05-17 · CVE-2012-5657

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zend Framework versions 1.11.x through 1.11.14 Zend Framework versions 1.12.x through 1.12.0

Description The issue allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, and possibly cause a denial of service due to CPU and memory consumption via an XML External Entity (XXE) attack. This is achieved by exploiting the Zend Feed Rss and Zend Feed Atom classes in Zend Feed.

Recommendations For versions 1.11.x through 1.11.14, update to version 1.11.15 or later. For versions 1.12.x through 1.12.0, update to version 1.12.1 or later.

Correção

DoS

Information Disclosure

XXE

Enumeração de Fraquezas

CWE-200

CWE-611

Identificadores relacionados

CVE-2012-5657

DSA-2602-1

DSA-3265-1

DSA-3265-2

GHSA-9M5V-VQ4F-MRVF

Produtos afetados

Zend Framework

Referências · 35

• https://github.com/zendframework/zf1 · Nota
• https://github.com/zendframework/zf1/commit/15c84914f063efea49ea1c4425459a792cc185ea · Nota
• https://web.archive.org/web/20131101014013/http://mandriva.com/en/support/security/advisories/advisory/MDVSA-2013:115/?name=MDVSA-2013:115 · Nota
• http://debian.org/security/2012/dsa-2602 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-9m5v-vq4f-mrvf · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2681 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5657 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2685 · Nota de Segurança
• http://mandriva.com/security/advisories?name=MDVSA-2013:115 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2684 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4914 · Nota de Segurança
• http://framework.zend.com/security/advisory/ZF2012-05 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6532 · Nota de Segurança
• https://security-tracker.debian.org/tracker/DSA-3265-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/DSA-3265-2 · Aviso do Fabricante