Description
The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.
Remediation
References
Related Vulnerabilities
WordPress Plugin WP People 'wp-people-popup.php' SQL Injection (2.0)
Apache Tomcat Permissions, Privileges, and Access Controls Vulnerability (CVE-2011-5062)
MySQL CVE-2024-21163 Vulnerability (CVE-2024-21163)
Magento Incorrect Authorization Vulnerability (CVE-2020-24401)
Django Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2018-6188)