VULNERABILITY INTELLIGENCE

CVE-2012-4399

CVSS score7.5 HIGH
EPSS probability12.09%
CISA KEVNot currently listed
Published2012-10-09
Last modified2026-06-16
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.

Weakness classification

  • CWE-611: Improper Restriction of XML External Entity Reference

Primary references