CVE-2012-4399 in the critical feed json
CakePHPallows remote attackers to read arbitrary files via XML data containing external entity references
published 2012-10-09 14 y ago modified 2026-06-16 4 mo ago also GHSA-5964-pq8r-4q62 , EUVD-2022-2545
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 12.1%
- EPSS 12.1% chance of exploitation in 30 days, percentile 96%
- public exploits
- 1
- Exploit-DB
Summary
The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.
Patch / fix
- packagist cakephp/cakephp 2.1.5, 2.2.1
- cakefoundation cakephp 2.1.5, 2.2.1
Timeline
- First public exploit (EDB-19863)
- Published
Exploit prediction
12.09% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- EDB-19863 CakePHP 2.x < 2.2.0-RC2 - XML External Entity Injection webapps, 2012-07-16
- seclists.org http://seclists.org/bugtraq/2012/Jul/101 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | cakephp/cakephp | >=2.1.0-alpha, <2.1.5 >=2.2.0-beta, <2.2.1 |
2.1.5 2.2.1 |
Classification
- Weakness
-
- CWE-611 Improper Restriction of XML External Entity Reference
References
-
exploit-db.com
/exploits/19863
exploit, web, third-party-advisory, vdb-entry
-
seclists.org
/bugtraq/2012/Jul/101
mailing-list, web, exploit, third-party-advisory
-
secunia.com
/advisories/49900
third-party-advisory, web, broken-link, vendor-advisory
-
bakery.cakephp.org
/articles/markstory/2012/07/14/security_release_-_cakephp_2_1_5_2_2_1
web, broken-link, vendor-advisory
-
osvdb.org
/84042
vdb-entry, web, broken-link
-
openwall.com
/lists/oss-security/2012/09/03/1
mailing-list, web
-
openwall.com
/lists/oss-security/2012/09/03/2
mailing-list, web
-
nvd.nist.gov
/vuln/detail/CVE-2012-4399
advisory
-
github.com
/cakephp/cakephp
package
Sources
- CVE List CVE-2012-4399
- GitHub Advisory GHSA-5964-pq8r-4q62
- NVD CVE-2012-4399
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.