Vulnerability Name:

CVE-2012-5657 (CCN-80718)

Assigned:2012-12-19
Published:2012-12-19
Updated:2013-05-03
Summary:The (1) Zend_Feed_Rss and (2) Zend_Feed_Atom classes in Zend_Feed in Zend Framework 1.11.x before 1.11.15 and 1.12.x before 1.12.1 allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, and possibly cause a denial of service (CPU and memory consumption) via an XML External Entity (XXE) attack.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): None
Availibility (A): None
CVSS v2 Severity:5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
Vulnerability Type:CWE-200
Vulnerability Consequences:Obtain Information
References:Source: MITRE
Type: CNA
CVE-2012-5657

Source: CCN
Type: ZF2012-05
Potential XML eXternal Entity injection vectors in Zend Framework 1 Zend_Feed component

Source: CONFIRM
Type: Vendor Advisory
http://framework.zend.com/security/advisory/ZF2012-05

Source: MLIST
Type: UNKNOWN
[oss-security] 20121219 CVE request: information disclosure flaw in php-ZendFramework (ZF2012-05)

Source: MLIST
Type: UNKNOWN
[oss-security] 20121219 Re: CVE request: information disclosure flaw in php-ZendFramework (ZF2012-05)

Source: CCN
Type: SA51583
Zend Framework "Zend_Feed" XML Entity References Information Disclosure Vulnerability

Source: SECUNIA
Type: Vendor Advisory
51583

Source: DEBIAN
Type: UNKNOWN
DSA-2602

Source: DEBIAN
Type: DSA-2602
zendframework -- XML external entity inclusion

Source: MANDRIVA
Type: UNKNOWN
MDVSA-2013:115

Source: CCN
Type: OSVDB ID: 88521
Zend Framework Zend_Feed::import() Factory Method XML External Entity (XXE) Data Parsing Arbitrary File Disclosure

Source: CCN
Type: OSVDB ID: 88522
Zend Framework Zend_Feed_Rss / Zend_Feed_Atom XML External Entity (XXE) Data Parsing Arbitrary File Disclosure

Source: CCN
Type: BID-56982
Zend Framework 'Zend_Feed' Component Information Disclosure Vulnerabilities

Source: XF
Type: UNKNOWN
zend-framework-zendfeed-info-disc(80718)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:zend:zend_framework:1.11.0:*:*:*:*:*:*:*
  • OR cpe:/a:zend:zend_framework:1.11.1:*:*:*:*:*:*:*
  • OR cpe:/a:zend:zend_framework:1.11.2:*:*:*:*:*:*:*
  • OR cpe:/a:zend:zend_framework:1.11.3:*:*:*:*:*:*:*
  • OR cpe:/a:zend:zend_framework:1.11.4:*:*:*:*:*:*:*
  • OR cpe:/a:zend:zend_framework:1.11.5:*:*:*:*:*:*:*
  • OR cpe:/a:zend:zend_framework:1.11.6:*:*:*:*:*:*:*
  • OR cpe:/a:zend:zend_framework:1.11.7:*:*:*:*:*:*:*
  • OR cpe:/a:zend:zend_framework:1.11.8:*:*:*:*:*:*:*
  • OR cpe:/a:zend:zend_framework:1.11.9:*:*:*:*:*:*:*
  • OR cpe:/a:zend:zend_framework:1.11.10:*:*:*:*:*:*:*
  • OR cpe:/a:zend:zend_framework:1.11.11:*:*:*:*:*:*:*
  • OR cpe:/a:zend:zend_framework:1.11.12:*:*:*:*:*:*:*
  • OR cpe:/a:zend:zend_framework:1.11.13:*:*:*:*:*:*:*
  • OR cpe:/a:zend:zend_framework:1.12.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:20156
    P
    		DSA-2602-1 zendframework - XML external entity inclusion
    2014-06-23
    oval:com.ubuntu.cosmic:def:201256570000000
    V
    		CVE-2012-5657 on Ubuntu 18.10 (cosmic) - medium.
    2013-05-02
    oval:com.ubuntu.artful:def:20125657000
    V
    		CVE-2012-5657 on Ubuntu 17.10 (artful) - medium.
    2013-05-02
    oval:com.ubuntu.trusty:def:20125657000
    V
    		CVE-2012-5657 on Ubuntu 14.04 LTS (trusty) - medium.
    2013-05-02
    oval:com.ubuntu.bionic:def:201256570000000
    V
    		CVE-2012-5657 on Ubuntu 18.04 LTS (bionic) - medium.
    2013-05-02
    oval:com.ubuntu.bionic:def:20125657000
    V
    		CVE-2012-5657 on Ubuntu 18.04 LTS (bionic) - medium.
    2013-05-02
    oval:com.ubuntu.xenial:def:20125657000
    V
    		CVE-2012-5657 on Ubuntu 16.04 LTS (xenial) - medium.
    2013-05-02
    oval:com.ubuntu.xenial:def:201256570000000
    V
    		CVE-2012-5657 on Ubuntu 16.04 LTS (xenial) - medium.
    2013-05-02
    oval:com.ubuntu.cosmic:def:20125657000
    V
    		CVE-2012-5657 on Ubuntu 18.10 (cosmic) - medium.
    2013-05-02
    oval:com.ubuntu.precise:def:20125657000
    V
    		CVE-2012-5657 on Ubuntu 12.04 LTS (precise) - medium.
    2013-05-02
    BACK
    zend zend framework 1.11.0
    zend zend framework 1.11.1
    zend zend framework 1.11.2
    zend zend framework 1.11.3
    zend zend framework 1.11.4
    zend zend framework 1.11.5
    zend zend framework 1.11.6
    zend zend framework 1.11.7
    zend zend framework 1.11.8
    zend zend framework 1.11.9
    zend zend framework 1.11.10
    zend zend framework 1.11.11
    zend zend framework 1.11.12
    zend zend framework 1.11.13
    zend zend framework 1.12.0