CVE-2012-3363
Critical · 9.1CVSS
9.1
EPSS
49.3%
Published
Feb 13, 2013
CISA due date
—
The record
Zend_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not properly handle SimpleXMLElement classes, which allows remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML external entity (XXE) injection attack.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | zendframework/zendframework1 | 1.0.0 | 1.11.12 |
| Packagist | zendframework/zendframework1 | 1.12.0-rc1 | 1.12.0 |
| Debian:6.0 | zendframework | 0 | 1.10.6-1squeeze1 |
| Ubuntu:16.04:LTS | zend-framework | 0 | No fix |
| Ubuntu:18.04:LTS | zendframework | 0 | 1.12.20+dfsg-1ubuntu1 |
| Ubuntu:Pro:16.04:LTS | zend-framework | 0 | No fix |
| packagist | zendframework/zendframework1 | 1.0 | No fix |
| packagist | zendframework/zendframework1 | 1.12.0-rc1 | No fix |
Related vulnerabilities
- CVE-2026-89260 MoguBlog through 6.2 contains an XML external entity injection vulnerability in the… CWE-611
- CVE-2026-84941 An information disclosure vulnerability in the SAML Single Sign-On (SSO) functionality of… CWE-611
- CVE-2026-79572 An XXE (XML External Entity) vulnerability in the level-rule module of Distribution… CWE-611
- CVE-2026-19614 The API is prone to XML external entity (XXE) injection. CWE-611
- CVE-2026-71375 Improper restriction of XML external entity reference vulnerability in Cosminexus… CWE-611
- CVE-2026-76958 SAP Integration Suite does not sufficiently validate XML documents accepted from… CWE-611
- CVE-2026-17444 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and… CWE-611
- CVE-2026-17443 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and… CWE-611