Zend Framework XEE Vulnerability

published 2013-02-13 13 y ago modified 2026-06-16 4 mo ago also GHSA-h5p3-7mg6-hgj4 , EUVD-2022-4074

cvss: 6.4; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 2.5%; EPSS 2.5% chance of exploitation in 30 days, percentile 84%
public exploits: 0; none known

(1) Zend_Dom, (2) Zend_Feed, and (3) Zend_Soap in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 do not properly handle SimpleXMLElement classes, which allow remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML external entity (XXE) injection attack, a different vulnerability than CVE-2012-3363.

Patch / fix

fixed in 1 links 1

packagist zendframework/zendframework1 1.11.13, 1.12.0

github.com/zendframework/zf1@1b5e861 commit

Exploit prediction

2.52% chance of exploitation in the next 30 days, higher than 84% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	2.0	6.4	AV:N/AC:L/Au:N/C:P/I:P/A:N

Affected packages

ecosystem	package	affected	fixed in
packagist	zendframework/zendframework1	>=1.0, <1.11.13 >=1.12.0-rc1, <1.12.0	1.11.13 1.12.0

Classification

Weakness

CWE-20 Improper Input Validation
CWE-776 Improper Restriction of Recursive Entity References in DTDs

References

github.com /zendframework/zf1/commit/1b5e86183a72b7b10b6c89e4f95f08c5da9716db
web
debian.org /security/2012/dsa-2505
vendor-advisory, web
framework.zend.com /security/advisory/ZF2012-01
web, vendor-advisory
openwall.com /lists/oss-security/2012/06/27/2
mailing-list, web
openwall.com /lists/oss-security/2012/06/26/4
mailing-list, web
openwall.com /lists/oss-security/2012/06/26/2
mailing-list, web
sec-consult.com /files/20120626-0_zend_framework_xxe_injection.txt
web
nvd.nist.gov /vuln/detail/CVE-2012-6531
advisory
github.com /zendframework/zf1
package

Sources

CVE List CVE-2012-6531
GitHub Advisory GHSA-h5p3-7mg6-hgj4
NVD CVE-2012-6531

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary