CVE-2012-4399 CakePHPallows remote attackers to read arbitrary files via XML data containing external entity references
HighCVSS 7.5
EPSS 12.1%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cakephp/cakephp(Packagist) | >= 2.1.0-alpha, < 2.1.5 | 2.1.5 |
| cakephp/cakephp(Packagist) | >= 2.2.0-beta, < 2.2.1 | 2.2.1 |
| cakefoundation cakephp | >= 2.1.0, < 2.1.5 | 2.1.5 |
| cakefoundation cakephp | >= 2.2.0, < 2.2.1 | 2.2.1 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com product
- bakery.cakephp.org broken-link vendor-advisory
- 20120716 CakePHP 2.x-2.2.0-RC2 XXE Injection exploit mailing-list third-party-advisory
- 49900 broken-link third-party-advisory vendor-advisory
- 19863 exploit third-party-advisory vdb-entry
- [oss-security] 20120903 CVE-request: CakePHP XXE injection mailing-list
- [oss-security] 20120903 Re: CVE-request: CakePHP XXE injection mailing-list
- 84042 broken-link vdb-entry
- github.com