PT-2024-40074 · Zend · Zend Framework

Published 2024-06-07 · Updated 2024-06-07

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Zend Framework versions prior to 1.11.13 and 1.12.0

Description: The issue concerns the insecure usage of PHP's DOM extension in Zend Feed Rss and Zend Feed Atom, allowing for potential XML eXternal Entity (XXE) vectors. This could be exploited by adding a specific DOCTYPE element to feeds, enabling the opening of arbitrary files and/or TCP connections.

Recommendations: For versions prior to 1.11.13 and 1.12.0, consider updating to version 1.11.13 or 1.12.0 to resolve the issue. As a temporary workaround, consider restricting the usage of the Zend Feed Rss and Zend Feed Atom classes until a patch is applied. Additionally, avoid using the Zend Feed::import() factory method with untrusted input until the issue is resolved.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

GHSA-4J9X-G4X8-VCMF

Affected Products

Zend Framework

References · 4

• https://osv.dev/vulnerability/GHSA-4j9x-g4x8-vcmf · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/ZF2012-05.yaml · Note
• https://github.com/zendframework/zf1 · Note
• https://framework.zend.com/security/advisory/ZF2012-05 · Note