Read the docs
TI-2012-02894 Aliases CVE-2012-3363GHSA-7pg4-5233-82jv

Zend_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not…

Priority HIGH 78CWE-611Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub.

Summary

Zend_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not properly handle SimpleXMLElement classes, which allows remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML external entity (XXE) injection attack.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.49313 98th percentileScored 2026-11-07
Fix Fixed zendframework/zendframework1 (Packagist): 1.11.12, 1.12.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—zendframework/zendframework1 (Packagist)1.0.0 to before 1.11.121.11.12Patch availableGHSA-7pg4-5233-82jv
—zendframework/zendframework1 (Packagist)1.12.0-rc1 to before 1.12.01.12.0Patch availableGHSA-7pg4-5233-82jv
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • zendframework/zendframework1 (Packagist) Vendor— Affected 1.0.0 to before 1.11.12 Fixed in 1.11.12 Patch available GHSA-7pg4-5233-82jv
  • zendframework/zendframework1 (Packagist) Vendor— Affected 1.12.0-rc1 to before 1.12.0 Fixed in 1.12.0 Patch available GHSA-7pg4-5233-82jv

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:zend:zend_framework:*:*:*:*:*:*:*:*1.0.0 to before 1.11.12VulnerableZend
cpe:2.3:a:zend:zend_framework:1.12.0:rc1:*:*:*:*:*:*1.12.0 rc1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.12.0:rc2:*:*:*:*:*:*1.12.0 rc2VulnerableZend
cpe:2.3:a:zend:zend_framework:1.12.0:rc3:*:*:*:*:*:*1.12.0 rc3VulnerableZend
cpe:2.3:a:zend:zend_framework:1.12.0:rc4:*:*:*:*:*:*1.12.0 rc4VulnerableZend
cpe:2.3:o:fedoraproject:fedora:17:*:*:*:*:*:*:*17VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:18:*:*:*:*:*:*:*18VulnerableFedoraproject
cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*6.0VulnerableDebian
  • cpe:2.3:a:zend:zend_framework:*:*:*:*:*:*:*:* Versions 1.0.0 to before 1.11.12 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.12.0:rc1:*:*:*:*:*:* Versions 1.12.0 rc1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.12.0:rc2:*:*:*:*:*:* Versions 1.12.0 rc2 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.12.0:rc3:*:*:*:*:*:* Versions 1.12.0 rc3 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.12.0:rc4:*:*:*:*:*:* Versions 1.12.0 rc4 Vulnerable ·Zend
  • cpe:2.3:o:fedoraproject:fedora:17:*:*:*:*:*:*:* Versions 17 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:18:*:*:*:*:*:*:* Versions 18 Vulnerable ·Fedoraproject
  • cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Debian

Remediation

  • Fix · GHSA-7pg4-5233-82jv zendframework/zendframework1 (Packagist) Fixed in 1.11.12 Advisory →
  • Fix · GHSA-7pg4-5233-82jv zendframework/zendframework1 (Packagist) Fixed in 1.12.0 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2012-3363
  2. 2026-10-03 Alias added: GHSA-7pg4-5233-82jv

References

Patch 1

Advisory 6

Other 8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences