VulnerableCode Vulnerability Details

Search for vulnerabilities

Vulnerability details: VCID-r4sj-m8p3-aaaq

Essentials
Severities (104)
References (21)
Severity details (15)
Exploits (0)
EPSS
History (0)

Vulnerability ID	VCID-r4sj-m8p3-aaaq
Aliases	CVE-2012-6685 GHSA-6wj9-77wq-jq7p OSV-90946
Summary	XML External Entity (XXE) Expansion Internal Network Response Remote Nokogiri is vulnerable to XXE attacks.
Status	Published
Exploitability	0.5
Weighted Severity	8.0
Risk	4.0
Affected and Fixed Packages	Package Details

Weaknesses (4)

CWE-776	Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
CWE-1035	OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937	OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-611	Improper Restriction of XML External Entity Reference

System	Score	Found at
generic_textual	Medium	http://people.canonical.com/~ubuntu-security/cve/2012/CVE-2012-6685.html
rhas	Moderate	https://access.redhat.com/errata/RHSA-2019:0212
epss	0.00182	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00182	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00182	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00182	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00182	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00182	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00182	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00182	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00182	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00182	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00182	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00182	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00247	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00247	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00247	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00247	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00323	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00323	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00323	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00323	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00323	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00323	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00444	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00444	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00444	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00444	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00444	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00444	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00444	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00444	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00444	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00444	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00444	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00444	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00444	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00444	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00444	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00444	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00447	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00447	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00447	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00447	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00447	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00447	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00447	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00447	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00447	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00447	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00447	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00447	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00447	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00447	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00447	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00447	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00447	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00447	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00447	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00447	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00447	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00447	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00447	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00447	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00447	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00447	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00447	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00447	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00447	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00447	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00447	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00447	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00447	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00447	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00447	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00447	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00447	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00447	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00447	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00447	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00447	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00447	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00447	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00447	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00447	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00447	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00447	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00447	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00447	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.00447	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
epss	0.01518	https://api.first.org/data/v1/epss?cve=CVE-2012-6685
rhbs	medium	https://bugzilla.redhat.com/show_bug.cgi?id=1178970
generic_textual	Medium	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6685
cvssv3.1_qr	HIGH	https://github.com/advisories/GHSA-6wj9-77wq-jq7p
cvssv3.1_qr	MODERATE	https://github.com/advisories/GHSA-6wj9-77wq-jq7p
cvssv3.1	8.2	https://github.com/sparklemotion/nokogiri
generic_textual	HIGH	https://github.com/sparklemotion/nokogiri
cvssv3.1	7.5	https://github.com/sparklemotion/nokogiri/issues/693
generic_textual	HIGH	https://github.com/sparklemotion/nokogiri/issues/693
cvssv3.1	7.5	https://nokogiri.org/CHANGELOG.html#154-2012-06-12
generic_textual	HIGH	https://nokogiri.org/CHANGELOG.html#154-2012-06-12
cvssv2	5.0	https://nvd.nist.gov/vuln/detail/CVE-2012-6685
cvssv3	7.5	https://nvd.nist.gov/vuln/detail/CVE-2012-6685
cvssv3.1	7.5	https://nvd.nist.gov/vuln/detail/CVE-2012-6685

Reference id	Reference type	URL
		http://people.canonical.com/~ubuntu-security/cve/2012/CVE-2012-6685.html
		https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-6685.json
		https://api.first.org/data/v1/epss?cve=CVE-2012-6685
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6685
		https://github.com/sparklemotion/nokogiri
		https://github.com/sparklemotion/nokogiri/commit/599856367150709497a3a03bee930bd76504d95d
		https://github.com/sparklemotion/nokogiri/issues/693
		https://nokogiri.org/CHANGELOG.html#154-2012-06-12
1178970		https://bugzilla.redhat.com/show_bug.cgi?id=1178970
cpe:2.3:a:nokogiri:nokogiri::::::::		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:nokogiri:nokogiri::::::::
cpe:2.3:a:redhat:cloudforms_management_engine:5.0:::::::*		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:cloudforms_management_engine:5.0:::::::*
cpe:2.3:a:redhat:openshift:2.0::::enterprise:::		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:openshift:2.0::::enterprise:::
cpe:2.3:a:redhat:openstack:4.0:::::::*		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:openstack:4.0:::::::*
cpe:2.3:a:redhat:openstack:6.0:::::::*		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:openstack:6.0:::::::*
cpe:2.3:a:redhat:openstack_foreman:-:::::::*		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:openstack_foreman:-:::::::*
cpe:2.3:a:redhat:satellite:6.0:::::::*		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:satellite:6.0:::::::*
cpe:2.3:a:redhat:subscription_asset_manager:-:::::::*		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:subscription_asset_manager:-:::::::*
cpe:2.3:o:redhat:enterprise_mrg:2.0:::::::*		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_mrg:2.0:::::::*
CVE-2012-6685		https://nvd.nist.gov/vuln/detail/CVE-2012-6685
GHSA-6wj9-77wq-jq7p		https://github.com/advisories/GHSA-6wj9-77wq-jq7p
RHSA-2019:0212		https://access.redhat.com/errata/RHSA-2019:0212

No exploits are available.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H Found at https://github.com/sparklemotion/nokogiri

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/sparklemotion/nokogiri/issues/693

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://nokogiri.org/CHANGELOG.html#154-2012-06-12

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2012-6685

Exploitability (E)	Access Vector (AV)	Access Complexity (AC)	Authentication (Au)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
high functional unproven proof_of_concept not_defined	local adjacent_network network	high medium low	multiple single none	none partial complete	none partial complete	none partial complete

Exploitability (E)

Access Vector (AV)

Access Complexity (AC)

Authentication (Au)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

partial

complete

none

partial

complete

none

partial

complete

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2012-6685

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2012-6685

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Exploit Prediction Scoring System (EPSS)

Percentile	0.56207
EPSS Score	0.00182
Published At	Nov. 1, 2024, midnight

Date	Actor	Action	Source	VulnerableCode Version
There are no relevant records.