Description

The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.

Remediation

References

CVE-2012-4399

Related Vulnerabilities

WordPress Plugin AVH Extended Categories Widgets Unspecified Vulnerability (4.0.2)

WordPress Plugin TableOn-WordPress Posts Table Filterable Cross-Site Scripting (1.0.0)

WordPress Plugin WP Marketplace-Complete Shopping Cart/eCommerce Solution Arbitrary File Upload (2.4.1)

PHP Other Vulnerability (CVE-2014-4670)

Oracle Database Server CVE-2007-5504 Vulnerability (CVE-2007-5504)

Severity

Medium

Classification

CVE-2012-4399 CWE-264

Tags

Missing Update Known Vulnerabilities