Description

The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.

Remediation

References

CVE-2012-4399

Related Vulnerabilities

Nginx Out-of-bounds Read Vulnerability (CVE-2023-27730)

ownCloud Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2012-4394)

MyBB Server-Side Request Forgery (SSRF) Vulnerability (CVE-2016-9417)

Pega Infinity Weak Password Recovery Mechanism for Forgotten Password Vulnerability (CVE-2021-27654)

ownCloud Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2014-9044)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-264 CVE-2012-4399