Description

The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.

Remediation

References

CVE-2012-4399

Related Vulnerabilities

WordPress Plugin Simple Schools Staff Directory Arbitrary File Upload (1.1)

WordPress Plugin VK All in One Expansion Unit Cross-Site Scripting (9.85.0.1)

IBM RTC Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2018-1407)

WordPress Plugin Great Quotes Cross-Site Scripting (1.0.0)

phpMyFAQ Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-6890)

Severity

Medium

Classification

CVE-2012-4399 CWE-264

Tags

Missing Update Known Vulnerabilities