{"api_version":"1","generated_at":"2026-06-21T19:47:50+00:00","cve":"CVE-2012-4399","urls":{"html":"https://cve.report/CVE-2012-4399","api":"https://cve.report/api/cve/CVE-2012-4399.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2012-4399","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2012-4399"},"summary":{"title":"CVE-2012-4399","description":"The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.","state":"PUBLISHED","assigner":"redhat","published_at":"2012-10-09 23:55:05","updated_at":"2026-04-29 01:13:23"},"problem_types":["CWE-611","n/a"],"metrics":[{"version":"3.1","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2012/09/03/2","name":"http://www.openwall.com/lists/oss-security/2012/09/03/2","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"title":"oss-security - Re: CVE-request: CakePHP XXE injection","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.openwall.com/lists/oss-security/2012/09/03/1","name":"http://www.openwall.com/lists/oss-security/2012/09/03/1","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"title":"oss-security - CVE-request: CakePHP XXE injection","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.exploit-db.com/exploits/19863","name":"http://www.exploit-db.com/exploits/19863","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory","VDB Entry"],"title":"CakePHP 2.x-2.2.0-RC2 XXE Injection","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://seclists.org/bugtraq/2012/Jul/101","name":"http://seclists.org/bugtraq/2012/Jul/101","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Mailing List","Third Party Advisory"],"title":"Bugtraq: CakePHP 2.x-2.2.0-RC2 XXE Injection","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://bakery.cakephp.org/articles/markstory/2012/07/14/security_release_-_cakephp_2_1_5_2_2_1","name":"http://bakery.cakephp.org/articles/markstory/2012/07/14/security_release_-_cakephp_2_1_5_2_2_1","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link","Vendor Advisory"],"title":"Security Release - CakePHP 2.1.5 & 2.2.1 :: \r\n\t\tThe Bakery: Everything CakePHP","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"http://www.osvdb.org/84042","name":"http://www.osvdb.org/84042","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://secunia.com/advisories/49900","name":"http://secunia.com/advisories/49900","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link","Vendor Advisory"],"title":"About Secunia Research | Flexera","mime":"text/plain","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-4399","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-4399","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2012","cve_id":"4399","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cakefoundation","cpe5":"cakephp","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T20:35:09.243Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"49900","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/49900"},{"name":"20120716 CakePHP 2.x-2.2.0-RC2 XXE Injection","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://seclists.org/bugtraq/2012/Jul/101"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://bakery.cakephp.org/articles/markstory/2012/07/14/security_release_-_cakephp_2_1_5_2_2_1"},{"name":"19863","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"http://www.exploit-db.com/exploits/19863"},{"name":"84042","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://www.osvdb.org/84042"},{"name":"[oss-security] 20120903 CVE-request: CakePHP XXE injection","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://www.openwall.com/lists/oss-security/2012/09/03/1"},{"name":"[oss-security] 20120903 Re: CVE-request: CakePHP XXE injection","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://www.openwall.com/lists/oss-security/2012/09/03/2"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"descriptions":[{"lang":"en","value":"The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2012-10-09T23:00:00.000Z","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat"},"references":[{"name":"49900","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/49900"},{"name":"20120716 CakePHP 2.x-2.2.0-RC2 XXE Injection","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://seclists.org/bugtraq/2012/Jul/101"},{"tags":["x_refsource_CONFIRM"],"url":"http://bakery.cakephp.org/articles/markstory/2012/07/14/security_release_-_cakephp_2_1_5_2_2_1"},{"name":"19863","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"http://www.exploit-db.com/exploits/19863"},{"name":"84042","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://www.osvdb.org/84042"},{"name":"[oss-security] 20120903 CVE-request: CakePHP XXE injection","tags":["mailing-list","x_refsource_MLIST"],"url":"http://www.openwall.com/lists/oss-security/2012/09/03/1"},{"name":"[oss-security] 20120903 Re: CVE-request: CakePHP XXE injection","tags":["mailing-list","x_refsource_MLIST"],"url":"http://www.openwall.com/lists/oss-security/2012/09/03/2"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"secalert@redhat.com","ID":"CVE-2012-4399","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"49900","refsource":"SECUNIA","url":"http://secunia.com/advisories/49900"},{"name":"20120716 CakePHP 2.x-2.2.0-RC2 XXE Injection","refsource":"BUGTRAQ","url":"http://seclists.org/bugtraq/2012/Jul/101"},{"name":"http://bakery.cakephp.org/articles/markstory/2012/07/14/security_release_-_cakephp_2_1_5_2_2_1","refsource":"CONFIRM","url":"http://bakery.cakephp.org/articles/markstory/2012/07/14/security_release_-_cakephp_2_1_5_2_2_1"},{"name":"19863","refsource":"EXPLOIT-DB","url":"http://www.exploit-db.com/exploits/19863"},{"name":"84042","refsource":"OSVDB","url":"http://www.osvdb.org/84042"},{"name":"[oss-security] 20120903 CVE-request: CakePHP XXE injection","refsource":"MLIST","url":"http://www.openwall.com/lists/oss-security/2012/09/03/1"},{"name":"[oss-security] 20120903 Re: CVE-request: CakePHP XXE injection","refsource":"MLIST","url":"http://www.openwall.com/lists/oss-security/2012/09/03/2"}]}}}},"cveMetadata":{"assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","assignerShortName":"redhat","cveId":"CVE-2012-4399","datePublished":"2012-10-09T23:00:00.000Z","dateReserved":"2012-08-21T00:00:00.000Z","dateUpdated":"2024-09-16T17:14:37.653Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2012-10-09 23:55:05","lastModifiedDate":"2026-04-29 01:13:23","problem_types":["CWE-611","n/a"],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:cakefoundation:cakephp:*:*:*:*:*:*:*:*","versionStartIncluding":"2.1.0","versionEndExcluding":"2.1.5","matchCriteriaId":"8014FFA3-4C7C-49FE-BEA6-FB746217648F"},{"vulnerable":true,"criteria":"cpe:2.3:a:cakefoundation:cakephp:*:*:*:*:*:*:*:*","versionStartIncluding":"2.2.0","versionEndExcluding":"2.2.1","matchCriteriaId":"14D77E0C-4AB9-4542-AD3C-7EE88550E11E"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2012","CveId":"4399","Ordinal":"1","Title":"CVE-2012-4399","CVE":"CVE-2012-4399","Year":"2012"},"notes":[{"CveYear":"2012","CveId":"4399","Ordinal":"1","NoteData":"The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.","Type":"Description","Title":"CVE-2012-4399"},{"CveYear":"2012","CveId":"4399","Ordinal":"2","NoteData":"2012-10-09","Type":"Other","Title":"Published"}]}}}