CVE-2012-4399
CVE-2012-4399
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.
CVSS 7.5 · High · EPSS 12.1% · Public exploit · Fix available
- Published
- Updated
Stack: php
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
cakephp/cakephp Packagist
- Affected ranges
- ECOSYSTEM: ≥ 2.1.0-alpha, < 2.1.5
Update to 2.1.5
cakephp/cakephp Packagist
- Affected ranges
- ECOSYSTEM: ≥ 2.2.0-beta, < 2.2.1
Update to 2.2.1
Original sources
- http://secunia.com/advisories/49900
- http://seclists.org/bugtraq/2012/Jul/101
- http://bakery.cakephp.org/articles/markstory/2012/07/14/security_release_-_cakephp_2_1_5_2_2_1
- http://www.exploit-db.com/exploits/19863
- http://www.osvdb.org/84042
- http://www.openwall.com/lists/oss-security/2012/09/03/1
- http://www.openwall.com/lists/oss-security/2012/09/03/2
- https://nvd.nist.gov/vuln/detail/CVE-2012-4399