PT-2013-1828 · Zend · Zend Framework

Yury Dyachenko · Published 2013-05-02 · Updated 2022-05-17 · CVE-2012-5657

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zend Framework versions 1.11.x through 1.11.14 Zend Framework versions 1.12.x through 1.12.0

Description The issue allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, and possibly cause a denial of service due to CPU and memory consumption via an XML External Entity (XXE) attack. This is achieved by exploiting the Zend Feed Rss and Zend Feed Atom classes in Zend Feed.

Recommendations For versions 1.11.x through 1.11.14, update to version 1.11.15 or later. For versions 1.12.x through 1.12.0, update to version 1.12.1 or later.

Fix

DoS

Information Disclosure

XXE

Weakness Enumeration

CWE-200

CWE-611

Related Identifiers

CVE-2012-5657

DSA-2602-1

DSA-3265-1

DSA-3265-2

GHSA-9M5V-VQ4F-MRVF

Affected Products

Zend Framework

References · 35

• http://debian.org/security/2012/dsa-2602 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9m5v-vq4f-mrvf · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2681 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5657 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2685 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2013:115 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2684 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4914 · Security Note
• http://framework.zend.com/security/advisory/ZF2012-05 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6532 · Security Note
• https://security-tracker.debian.org/tracker/DSA-3265-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3265-2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-5657 · Security Note
• http://secunia.com/advisories/51583 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2683 · Security Note