GET

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

GET /api/vulnerabilities/112405?format=api
HTTP 200 OK
Allow: GET, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "url": "http://public2.vulnerablecode.io/api/vulnerabilities/112405?format=api",
    "vulnerability_id": "VCID-nsuf-xar5-f3hj",
    "summary": "Zend Framework XXE Vulnerability\nThe (1) Zend_Feed_Rss and (2) Zend_Feed_Atom classes in Zend_Feed in Zend Framework 1.11.x before 1.11.15 and 1.12.x before 1.12.1 allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, and possibly cause a denial of service (CPU and memory consumption) via an XML External Entity (XXE) attack.",
    "aliases": [
        {
            "alias": "CVE-2012-5657"
        },
        {
            "alias": "GHSA-9m5v-vq4f-mrvf"
        }
    ],
    "fixed_packages": [
        {
            "url": "http://public2.vulnerablecode.io/api/packages/51343?format=api",
            "purl": "pkg:composer/zendframework/zendframework1@1.12.1",
            "is_vulnerable": true,
            "affected_by_vulnerabilities": [
                {
                    "vulnerability": "VCID-2ncq-wptr-k3ha"
                },
                {
                    "vulnerability": "VCID-2xx4-77e9-pfbb"
                },
                {
                    "vulnerability": "VCID-5bm4-grk6-w7hk"
                },
                {
                    "vulnerability": "VCID-649h-2f2f-nbam"
                },
                {
                    "vulnerability": "VCID-6fzg-den8-rqc8"
                },
                {
                    "vulnerability": "VCID-6xpr-93ef-27cu"
                },
                {
                    "vulnerability": "VCID-8atm-865q-mkf3"
                },
                {
                    "vulnerability": "VCID-9bm9-b48z-zqcm"
                },
                {
                    "vulnerability": "VCID-a72a-7k6u-rqgr"
                },
                {
                    "vulnerability": "VCID-afnn-53q5-wqft"
                },
                {
                    "vulnerability": "VCID-b1da-n1u7-43hj"
                },
                {
                    "vulnerability": "VCID-bjvu-jg9w-mqdd"
                },
                {
                    "vulnerability": "VCID-c8kp-n8m3-2khe"
                },
                {
                    "vulnerability": "VCID-e9ut-smfp-7yb4"
                },
                {
                    "vulnerability": "VCID-grk8-aj34-hqb4"
                },
                {
                    "vulnerability": "VCID-h5yf-ahec-gbgx"
                },
                {
                    "vulnerability": "VCID-n2gy-93nd-gber"
                },
                {
                    "vulnerability": "VCID-njsg-e1w1-9qcy"
                },
                {
                    "vulnerability": "VCID-ps73-776n-zffn"
                },
                {
                    "vulnerability": "VCID-q73m-16a9-rkgx"
                },
                {
                    "vulnerability": "VCID-q74z-645k-c7dk"
                },
                {
                    "vulnerability": "VCID-r5y8-nc2w-kqde"
                },
                {
                    "vulnerability": "VCID-rc3w-5r97-k3b3"
                },
                {
                    "vulnerability": "VCID-sjw9-2fwe-5ybg"
                },
                {
                    "vulnerability": "VCID-tpdc-c3mz-zyd2"
                },
                {
                    "vulnerability": "VCID-uvgx-4m6v-2bg7"
                },
                {
                    "vulnerability": "VCID-wkkp-82dc-huhr"
                }
            ],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.1"
        }
    ],
    "affected_packages": [
        {
            "url": "http://public2.vulnerablecode.io/api/packages/63559?format=api",
            "purl": "pkg:composer/zendframework/zendframework1@1.12.0-rc1",
            "is_vulnerable": true,
            "affected_by_vulnerabilities": [
                {
                    "vulnerability": "VCID-4f52-bffk-eug2"
                },
                {
                    "vulnerability": "VCID-nkxr-brbk-x7dj"
                },
                {
                    "vulnerability": "VCID-nsuf-xar5-f3hj"
                },
                {
                    "vulnerability": "VCID-wbb2-mubf-ukhk"
                }
            ],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.0-rc1"
        },
        {
            "url": "http://public2.vulnerablecode.io/api/packages/51134?format=api",
            "purl": "pkg:composer/zendframework/zendframework1@1.12.0",
            "is_vulnerable": true,
            "affected_by_vulnerabilities": [
                {
                    "vulnerability": "VCID-2ncq-wptr-k3ha"
                },
                {
                    "vulnerability": "VCID-2xx4-77e9-pfbb"
                },
                {
                    "vulnerability": "VCID-5bm4-grk6-w7hk"
                },
                {
                    "vulnerability": "VCID-649h-2f2f-nbam"
                },
                {
                    "vulnerability": "VCID-6fzg-den8-rqc8"
                },
                {
                    "vulnerability": "VCID-6xpr-93ef-27cu"
                },
                {
                    "vulnerability": "VCID-8atm-865q-mkf3"
                },
                {
                    "vulnerability": "VCID-9bm9-b48z-zqcm"
                },
                {
                    "vulnerability": "VCID-a72a-7k6u-rqgr"
                },
                {
                    "vulnerability": "VCID-afnn-53q5-wqft"
                },
                {
                    "vulnerability": "VCID-b1da-n1u7-43hj"
                },
                {
                    "vulnerability": "VCID-bjvu-jg9w-mqdd"
                },
                {
                    "vulnerability": "VCID-c8kp-n8m3-2khe"
                },
                {
                    "vulnerability": "VCID-cp1a-fprd-9fhk"
                },
                {
                    "vulnerability": "VCID-e9ut-smfp-7yb4"
                },
                {
                    "vulnerability": "VCID-grk8-aj34-hqb4"
                },
                {
                    "vulnerability": "VCID-h5yf-ahec-gbgx"
                },
                {
                    "vulnerability": "VCID-j5kg-jzxz-ruam"
                },
                {
                    "vulnerability": "VCID-n2gy-93nd-gber"
                },
                {
                    "vulnerability": "VCID-njsg-e1w1-9qcy"
                },
                {
                    "vulnerability": "VCID-nsuf-xar5-f3hj"
                },
                {
                    "vulnerability": "VCID-ps73-776n-zffn"
                },
                {
                    "vulnerability": "VCID-q73m-16a9-rkgx"
                },
                {
                    "vulnerability": "VCID-q74z-645k-c7dk"
                },
                {
                    "vulnerability": "VCID-r5y8-nc2w-kqde"
                },
                {
                    "vulnerability": "VCID-rc3w-5r97-k3b3"
                },
                {
                    "vulnerability": "VCID-sjw9-2fwe-5ybg"
                },
                {
                    "vulnerability": "VCID-tpdc-c3mz-zyd2"
                },
                {
                    "vulnerability": "VCID-uvgx-4m6v-2bg7"
                },
                {
                    "vulnerability": "VCID-wkkp-82dc-huhr"
                }
            ],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.0"
        }
    ],
    "references": [
        {
            "reference_url": "http://framework.zend.com/security/advisory/ZF2012-05",
            "reference_id": "",
            "reference_type": "",
            "scores": [
                {
                    "value": "MODERATE",
                    "scoring_system": "generic_textual",
                    "scoring_elements": ""
                }
            ],
            "url": "http://framework.zend.com/security/advisory/ZF2012-05"
        },
        {
            "reference_url": "http://openwall.com/lists/oss-security/2012/12/20/2",
            "reference_id": "",
            "reference_type": "",
            "scores": [
                {
                    "value": "MODERATE",
                    "scoring_system": "generic_textual",
                    "scoring_elements": ""
                }
            ],
            "url": "http://openwall.com/lists/oss-security/2012/12/20/2"
        },
        {
            "reference_url": "http://openwall.com/lists/oss-security/2012/12/20/4",
            "reference_id": "",
            "reference_type": "",
            "scores": [
                {
                    "value": "MODERATE",
                    "scoring_system": "generic_textual",
                    "scoring_elements": ""
                }
            ],
            "url": "http://openwall.com/lists/oss-security/2012/12/20/4"
        },
        {
            "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2012-5657",
            "reference_id": "",
            "reference_type": "",
            "scores": [
                {
                    "value": "0.00719",
                    "scoring_system": "epss",
                    "scoring_elements": "0.72856",
                    "published_at": "2026-06-07T12:55:00Z"
                },
                {
                    "value": "0.00719",
                    "scoring_system": "epss",
                    "scoring_elements": "0.72828",
                    "published_at": "2026-06-04T12:55:00Z"
                },
                {
                    "value": "0.00719",
                    "scoring_system": "epss",
                    "scoring_elements": "0.72866",
                    "published_at": "2026-06-05T12:55:00Z"
                },
                {
                    "value": "0.00719",
                    "scoring_system": "epss",
                    "scoring_elements": "0.72873",
                    "published_at": "2026-06-06T12:55:00Z"
                }
            ],
            "url": "https://api.first.org/data/v1/epss?cve=CVE-2012-5657"
        },
        {
            "reference_url": "https://github.com/zendframework/zf1",
            "reference_id": "",
            "reference_type": "",
            "scores": [
                {
                    "value": "MODERATE",
                    "scoring_system": "generic_textual",
                    "scoring_elements": ""
                }
            ],
            "url": "https://github.com/zendframework/zf1"
        },
        {
            "reference_url": "https://github.com/zendframework/zf1/commit/15c84914f063efea49ea1c4425459a792cc185ea",
            "reference_id": "",
            "reference_type": "",
            "scores": [
                {
                    "value": "MODERATE",
                    "scoring_system": "generic_textual",
                    "scoring_elements": ""
                }
            ],
            "url": "https://github.com/zendframework/zf1/commit/15c84914f063efea49ea1c4425459a792cc185ea"
        },
        {
            "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2012-5657",
            "reference_id": "",
            "reference_type": "",
            "scores": [
                {
                    "value": "MODERATE",
                    "scoring_system": "generic_textual",
                    "scoring_elements": ""
                }
            ],
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-5657"
        },
        {
            "reference_url": "https://web.archive.org/web/20131101014013/http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2013:115/?name=MDVSA-2013:115",
            "reference_id": "",
            "reference_type": "",
            "scores": [
                {
                    "value": "MODERATE",
                    "scoring_system": "generic_textual",
                    "scoring_elements": ""
                }
            ],
            "url": "https://web.archive.org/web/20131101014013/http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2013:115/?name=MDVSA-2013:115"
        },
        {
            "reference_url": "http://www.debian.org/security/2012/dsa-2602",
            "reference_id": "",
            "reference_type": "",
            "scores": [
                {
                    "value": "MODERATE",
                    "scoring_system": "generic_textual",
                    "scoring_elements": ""
                }
            ],
            "url": "http://www.debian.org/security/2012/dsa-2602"
        },
        {
            "reference_url": "https://github.com/advisories/GHSA-9m5v-vq4f-mrvf",
            "reference_id": "GHSA-9m5v-vq4f-mrvf",
            "reference_type": "",
            "scores": [],
            "url": "https://github.com/advisories/GHSA-9m5v-vq4f-mrvf"
        }
    ],
    "weaknesses": [
        {
            "cwe_id": 200,
            "name": "Exposure of Sensitive Information to an Unauthorized Actor",
            "description": "The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information."
        },
        {
            "cwe_id": 611,
            "name": "Improper Restriction of XML External Entity Reference",
            "description": "The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output."
        },
        {
            "cwe_id": 1035,
            "name": "OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities",
            "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017."
        },
        {
            "cwe_id": 937,
            "name": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities",
            "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013."
        }
    ],
    "exploits": [],
    "severity_range_score": "4.0 - 6.9",
    "exploitability": "0.5",
    "weighted_severity": "6.2",
    "risk_score": 3.1,
    "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-nsuf-xar5-f3hj"
}