Advisory details:
ubuntu_osv / UBUNTU-CVE-2012-3363
| Advisory ID | ubuntu_osv/UBUNTU-CVE-2012-3363 |
| Aliases |
CVE-2012-3363
|
| Summary | Zend_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not properly handle SimpleXMLElement classes, which allows remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML external entity (XXE) injection attack. |
| Status | Published |
| Exploitability | 2.0 |
| Weighted Severity | 8.2 |
| Risk | 10.0 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| There are no known CWE. |
| System | Score | Found at |
|---|---|---|
| cvssv3.1 | 9.1 | https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2012/UBUNTU-CVE-2012-3363.json |
| ubuntu-priority | medium | https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2012/UBUNTU-CVE-2012-3363.json |
| Reference id | Reference type | URL |
|---|---|---|
| https://ubuntu.com/security/CVE-2012-3363 | ||
| https://www.cve.org/CVERecord?id=CVE-2012-3363 | ||
| https://www.sec-consult.com/files/20120626-0_zend_framework_xxe_injection.txt | ||
| OSVDB-83221;CVE-2012-3363 | Exploit | http://framework.zend.com/security/advisory/ZF2012-01 |
| Data source | Exploit-DB |
|---|---|
| Date added | June 27, 2012 |
| Description | Zend Framework < 2.0.0 beta4 < 1.12 RC1 < 1.11.11 - Local File Disclosure |
| Ransomware campaign use | Unknown |
| Source publication date | June 27, 2012 |
| Exploit type | webapps |
| Platform | php |
| Source update date | Dec. 31, 2016 |
| Source URL | http://framework.zend.com/security/advisory/ZF2012-01 |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2025-01-16T20:38:37Z/
Decision: Track
Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2012/3xxx/CVE-2012-3363.json
Source Advisory: vulnrichment/CVE-2012-3363
[{'Exploitation': 'none'},
{'Automatable': 'yes'},
{'Technical Impact': 'total'},
{'Mission Prevalence': 'minimal'},
{'Public Well-being Impact': 'material'},
{'Mission & Well-being': 'medium'}]