{"api_version":"1","generated_at":"2026-07-23T07:23:59+00:00","cve":"CVE-2012-3363","urls":{"html":"https://cve.report/CVE-2012-3363","api":"https://cve.report/api/cve/CVE-2012-3363.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2012-3363","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2012-3363"},"summary":{"title":"CVE-2012-3363","description":"Zend_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not properly handle SimpleXMLElement classes, which allows remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML external entity (XXE) injection attack.","state":"PUBLISHED","assigner":"redhat","published_at":"2013-02-13 17:55:01","updated_at":"2026-04-29 01:13:23"},"problem_types":["CWE-611","n/a","CWE-611 CWE-611 Improper Restriction of XML External Entity Reference"],"metrics":[{"version":"3.1","source":"nvd@nist.gov","type":"Primary","score":"9.1","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"}},{"version":"3.1","source":"ADP","type":"DECLARED","score":"9.1","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}},{"version":"3.1","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","score":"9.1","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"}},{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"6.4","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:N","baseScore":6.4,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2012/06/27/2","name":"http://www.openwall.com/lists/oss-security/2012/06/27/2","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"title":"oss-security - Re: XXE in Zend","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://moodle.org/mod/forum/discuss.php?d=225345","name":"https://moodle.org/mod/forum/discuss.php?d=225345","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Moodle.org: MSA-13-0016: External Entity Injection through Zend library","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.debian.org/security/2012/dsa-2505","name":"http://www.debian.org/security/2012/dsa-2505","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"title":"Debian -- Security Information -- DSA-2505-1 zendframework","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-34284","name":"http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-34284","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"Official Moodle git projects - moodle.git/search","mime":"text/xml","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id?1027208","name":"http://www.securitytracker.com/id?1027208","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link","Third Party Advisory","VDB Entry"],"title":"Zend Framework XML Entity Processing Flaw Lets Remote Users View Files - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://openwall.com/lists/oss-security/2013/03/25/2","name":"http://openwall.com/lists/oss-security/2013/03/25/2","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"title":"oss-security - Moodle security notifications public","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.sec-consult.com/files/20120626-0_zend_framework_xxe_injection.txt","name":"https://www.sec-consult.com/files/20120626-0_zend_framework_xxe_injection.txt","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"],"title":"404 - Page not found! - SEC Consult","mime":"text/html","httpstatus":"404","archivestatus":"404"},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101358.html","name":"http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101358.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"title":"[SECURITY] Fedora 18 Update: moodle-2.3.6-1.fc18","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.openwall.com/lists/oss-security/2012/06/26/4","name":"http://www.openwall.com/lists/oss-security/2012/06/26/4","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"title":"oss-security - Re: XXE in Zend","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101310.html","name":"http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101310.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"title":"[SECURITY] Fedora 17 Update: moodle-2.2.9-1.fc17","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.openwall.com/lists/oss-security/2012/06/26/2","name":"http://www.openwall.com/lists/oss-security/2012/06/26/2","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"title":"oss-security - XXE in Zend","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://framework.zend.com/security/advisory/ZF2012-01","name":"http://framework.zend.com/security/advisory/ZF2012-01","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"ZF2012-01: Local file disclosure via XXE injection in Zend_XmlRpc - Advisories - Security - Zend Framework","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-3363","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-3363","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2012","cve_id":"3363","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"6.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"3363","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"fedoraproject","cpe5":"fedora","cpe6":"17","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"3363","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"fedoraproject","cpe5":"fedora","cpe6":"18","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"3363","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"zend","cpe5":"zend_framework","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"3363","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"zend","cpe5":"zend_framework","cpe6":"1.12.0","cpe7":"rc1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"3363","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"zend","cpe5":"zend_framework","cpe6":"1.12.0","cpe7":"rc2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"3363","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"zend","cpe5":"zend_framework","cpe6":"1.12.0","cpe7":"rc3","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"3363","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"zend","cpe5":"zend_framework","cpe6":"1.12.0","cpe7":"rc4","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2012-3363","qid":"996690","title":"PHP (Composer) Security Update for zendframework/zendframework1 (GHSA-7pg4-5233-82jv)"}]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T20:05:12.421Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://moodle.org/mod/forum/discuss.php?d=225345"},{"name":"FEDORA-2013-4387","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"],"url":"http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101358.html"},{"name":"[oss-security] 20120627 Re: XXE in Zend","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://www.openwall.com/lists/oss-security/2012/06/27/2"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-34284"},{"name":"DSA-2505","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"],"url":"http://www.debian.org/security/2012/dsa-2505"},{"name":"[oss-security] 20120626 Re: XXE in Zend","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://www.openwall.com/lists/oss-security/2012/06/26/4"},{"name":"FEDORA-2013-4404","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"],"url":"http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101310.html"},{"name":"[oss-security] 20120626 XXE in Zend","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://www.openwall.com/lists/oss-security/2012/06/26/2"},{"name":"[oss-security] 20130325 Moodle security notifications public","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://openwall.com/lists/oss-security/2013/03/25/2"},{"name":"1027208","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id?1027208"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://framework.zend.com/security/advisory/ZF2012-01"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://www.sec-consult.com/files/20120626-0_zend_framework_xxe_injection.txt"}],"title":"CVE Program Container"},{"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}},{"other":{"content":{"id":"CVE-2012-3363","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2025-01-16T20:38:37.378788Z","version":"2.0.3"},"type":"ssvc"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-611","description":"CWE-611 Improper Restriction of XML External Entity Reference","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2025-01-16T20:38:41.614Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2012-06-26T00:00:00.000Z","descriptions":[{"lang":"en","value":"Zend_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not properly handle SimpleXMLElement classes, which allows remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML external entity (XXE) injection attack."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2013-12-02T13:57:00.000Z","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat"},"references":[{"tags":["x_refsource_CONFIRM"],"url":"https://moodle.org/mod/forum/discuss.php?d=225345"},{"name":"FEDORA-2013-4387","tags":["vendor-advisory","x_refsource_FEDORA"],"url":"http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101358.html"},{"name":"[oss-security] 20120627 Re: XXE in Zend","tags":["mailing-list","x_refsource_MLIST"],"url":"http://www.openwall.com/lists/oss-security/2012/06/27/2"},{"tags":["x_refsource_CONFIRM"],"url":"http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-34284"},{"name":"DSA-2505","tags":["vendor-advisory","x_refsource_DEBIAN"],"url":"http://www.debian.org/security/2012/dsa-2505"},{"name":"[oss-security] 20120626 Re: XXE in Zend","tags":["mailing-list","x_refsource_MLIST"],"url":"http://www.openwall.com/lists/oss-security/2012/06/26/4"},{"name":"FEDORA-2013-4404","tags":["vendor-advisory","x_refsource_FEDORA"],"url":"http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101310.html"},{"name":"[oss-security] 20120626 XXE in Zend","tags":["mailing-list","x_refsource_MLIST"],"url":"http://www.openwall.com/lists/oss-security/2012/06/26/2"},{"name":"[oss-security] 20130325 Moodle security notifications public","tags":["mailing-list","x_refsource_MLIST"],"url":"http://openwall.com/lists/oss-security/2013/03/25/2"},{"name":"1027208","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id?1027208"},{"tags":["x_refsource_CONFIRM"],"url":"http://framework.zend.com/security/advisory/ZF2012-01"},{"tags":["x_refsource_MISC"],"url":"https://www.sec-consult.com/files/20120626-0_zend_framework_xxe_injection.txt"}]}},"cveMetadata":{"assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","assignerShortName":"redhat","cveId":"CVE-2012-3363","datePublished":"2013-02-13T17:00:00.000Z","dateReserved":"2012-06-14T00:00:00.000Z","dateUpdated":"2025-01-16T20:38:41.614Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2013-02-13 17:55:01","lastModifiedDate":"2026-04-29 01:13:23","problem_types":["CWE-611","n/a","CWE-611 CWE-611 Improper Restriction of XML External Entity Reference"],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:N","baseScore":6.4,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:zend:zend_framework:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"1.11.12","matchCriteriaId":"68B94C54-4E8F-4D13-9D0A-3E912D3E4545"},{"vulnerable":true,"criteria":"cpe:2.3:a:zend:zend_framework:1.12.0:rc1:*:*:*:*:*:*","matchCriteriaId":"A78C7EE7-7C12-45D2-913E-DC4902886C11"},{"vulnerable":true,"criteria":"cpe:2.3:a:zend:zend_framework:1.12.0:rc2:*:*:*:*:*:*","matchCriteriaId":"97F3ED10-8D1F-4D01-A79B-95AAF864B0BA"},{"vulnerable":true,"criteria":"cpe:2.3:a:zend:zend_framework:1.12.0:rc3:*:*:*:*:*:*","matchCriteriaId":"1E65648D-78FF-47D8-9F9E-66E9A8C121AB"},{"vulnerable":true,"criteria":"cpe:2.3:a:zend:zend_framework:1.12.0:rc4:*:*:*:*:*:*","matchCriteriaId":"DA6467DF-3983-4BB9-ACC7-C6AFE753E319"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:17:*:*:*:*:*:*:*","matchCriteriaId":"2DA9D861-3EAF-42F5-B0B6-A4CD7BDD6188"},{"vulnerable":true,"criteria":"cpe:2.3:o:fedoraproject:fedora:18:*:*:*:*:*:*:*","matchCriteriaId":"E14271AE-1309-48F3-B9C6-D7DEEC488279"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*","matchCriteriaId":"036E8A89-7A16-411F-9D31-676313BB7244"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2012","CveId":"3363","Ordinal":"1","Title":"CVE-2012-3363","CVE":"CVE-2012-3363","Year":"2012"},"notes":[{"CveYear":"2012","CveId":"3363","Ordinal":"1","NoteData":"Zend_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not properly handle SimpleXMLElement classes, which allows remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML external entity (XXE) injection attack.","Type":"Description","Title":"CVE-2012-3363"},{"CveYear":"2012","CveId":"3363","Ordinal":"2","NoteData":"2013-02-13","Type":"Other","Title":"Published"},{"CveYear":"2012","CveId":"3363","Ordinal":"3","NoteData":"2013-12-02","Type":"Other","Title":"Modified"}]}}}