Description

The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.

Remediation

References

CVE-2012-4399

Related Vulnerabilities

Internet Information Services Other Vulnerability (CVE-2001-0902)

WordPress Plugin WP e-Commerce Shop Styling Local File Inclusion (2.9.1)

WordPress Plugin Chamber Dashboard Member Manager Cross-Site Scripting (2.0.5)

PmWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2010-4662)

WordPress Plugin Google Doc Embedder Cross-Site Scripting (2.5.18)

Severity

Medium

Classification

CVE-2012-4399 CWE-264

Tags

Missing Update Known Vulnerabilities