CVE-2012-4399
1 advisory.
Packagist/cakephp/cakephp CVE-2012-4399: high 7.5
CakePHPallows remote attackers to read arbitrary files via XML data containing external entity references
Action: Upgrade cakephp/cakephp to 2.1.5 or later.
composer require cakephp/cakephp:2.1.5composer require cakephp/cakephp:2.2.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.1.0-alpha | 2.1.5 | - |
| 2.2.0-beta | 2.2.1 | - |
Fixed versions
| 2.1.5 | 2.2.1 |
Sources
- osv: GHSA-5964-pq8r-4q62
- https://nvd.nist.gov/vuln/detail/CVE-2012-4399
- https://github.com/cakephp/cakephp
- http://bakery.cakephp.org/articles/markstory/2012/07/14/security_release_-_cakephp_2_1_5_2_2_1
- http://seclists.org/bugtraq/2012/Jul/101
- http://secunia.com/advisories/49900
- http://www.exploit-db.com/exploits/19863
- http://www.openwall.com/lists/oss-security/2012/09/03/1
- http://www.openwall.com/lists/oss-security/2012/09/03/2
- http://www.osvdb.org/84042
CVE-2012-4399 · published · modified · JSON