Read the docs
TI-2012-05249 Aliases CVE-2012-6531GHSA-h5p3-7mg6-hgj4

(1) Zend_Dom, (2) Zend_Feed, and (3) Zend_Soap in Zend Framework 1.x before 1.11.13 and…

Priority LOW 33CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · None
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub.

Summary

(1) Zend_Dom, (2) Zend_Feed, and (3) Zend_Soap in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 do not properly handle SimpleXMLElement classes, which allow remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML external entity (XXE) injection attack, a different vulnerability than CVE-2012-3363.

Why it matters now

EPSS 0.02519 84th percentileScored 2026-11-07
Fix Fixed zendframework/zendframework1 (Packagist): 1.11.13, 1.12.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—zendframework/zendframework1 (Packagist)1.0 to before 1.11.131.11.13Patch availableGHSA-h5p3-7mg6-hgj4
—zendframework/zendframework1 (Packagist)1.12.0-rc1 to before 1.12.01.12.0Patch availableGHSA-h5p3-7mg6-hgj4
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • zendframework/zendframework1 (Packagist) Vendor— Affected 1.0 to before 1.11.13 Fixed in 1.11.13 Patch available GHSA-h5p3-7mg6-hgj4
  • zendframework/zendframework1 (Packagist) Vendor— Affected 1.12.0-rc1 to before 1.12.0 Fixed in 1.12.0 Patch available GHSA-h5p3-7mg6-hgj4

CPE configurations NVD · 59

CPEVersionsRoleVendor
cpe:2.3:a:zend:zend_framework:1.0.4:*:*:*:*:*:*:*1.0.4VulnerableZend
cpe:2.3:a:zend:zend_framework:1.5.0:*:*:*:*:*:*:*1.5.0VulnerableZend
cpe:2.3:a:zend:zend_framework:1.5.1:*:*:*:*:*:*:*1.5.1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.5.2:*:*:*:*:*:*:*1.5.2VulnerableZend
cpe:2.3:a:zend:zend_framework:1.5.3:*:*:*:*:*:*:*1.5.3VulnerableZend
cpe:2.3:a:zend:zend_framework:1.6.0:*:*:*:*:*:*:*1.6.0VulnerableZend
cpe:2.3:a:zend:zend_framework:1.6.1:*:*:*:*:*:*:*1.6.1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.6.2:*:*:*:*:*:*:*1.6.2VulnerableZend
cpe:2.3:a:zend:zend_framework:1.7.0:*:*:*:*:*:*:*1.7.0VulnerableZend
cpe:2.3:a:zend:zend_framework:1.7.1:*:*:*:*:*:*:*1.7.1VulnerableZend
  • cpe:2.3:a:zend:zend_framework:1.0.4:*:*:*:*:*:*:* Versions 1.0.4 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.5.0:*:*:*:*:*:*:* Versions 1.5.0 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.5.1:*:*:*:*:*:*:* Versions 1.5.1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.5.2:*:*:*:*:*:*:* Versions 1.5.2 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.5.3:*:*:*:*:*:*:* Versions 1.5.3 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.6.0:*:*:*:*:*:*:* Versions 1.6.0 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.6.1:*:*:*:*:*:*:* Versions 1.6.1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.6.2:*:*:*:*:*:*:* Versions 1.6.2 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.7.0:*:*:*:*:*:*:* Versions 1.7.0 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.7.1:*:*:*:*:*:*:* Versions 1.7.1 Vulnerable ·Zend
Show 49 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:zend:zend_framework:1.7.2:*:*:*:*:*:*:*1.7.2VulnerableZend
cpe:2.3:a:zend:zend_framework:1.7.3:*:*:*:*:*:*:*1.7.3VulnerableZend
cpe:2.3:a:zend:zend_framework:1.7.4:*:*:*:*:*:*:*1.7.4VulnerableZend
cpe:2.3:a:zend:zend_framework:1.7.5:*:*:*:*:*:*:*1.7.5VulnerableZend
cpe:2.3:a:zend:zend_framework:1.7.6:*:*:*:*:*:*:*1.7.6VulnerableZend
cpe:2.3:a:zend:zend_framework:1.7.7:*:*:*:*:*:*:*1.7.7VulnerableZend
cpe:2.3:a:zend:zend_framework:1.7.8:*:*:*:*:*:*:*1.7.8VulnerableZend
cpe:2.3:a:zend:zend_framework:1.7.9:*:*:*:*:*:*:*1.7.9VulnerableZend
cpe:2.3:a:zend:zend_framework:1.8.0:*:*:*:*:*:*:*1.8.0VulnerableZend
cpe:2.3:a:zend:zend_framework:1.8.1:*:*:*:*:*:*:*1.8.1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.8.2:*:*:*:*:*:*:*1.8.2VulnerableZend
cpe:2.3:a:zend:zend_framework:1.8.3:*:*:*:*:*:*:*1.8.3VulnerableZend
cpe:2.3:a:zend:zend_framework:1.8.4:*:*:*:*:*:*:*1.8.4VulnerableZend
cpe:2.3:a:zend:zend_framework:1.8.5:*:*:*:*:*:*:*1.8.5VulnerableZend
cpe:2.3:a:zend:zend_framework:1.9.0:*:*:*:*:*:*:*1.9.0VulnerableZend
cpe:2.3:a:zend:zend_framework:1.9.1:*:*:*:*:*:*:*1.9.1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.9.2:*:*:*:*:*:*:*1.9.2VulnerableZend
cpe:2.3:a:zend:zend_framework:1.9.3:*:*:*:*:*:*:*1.9.3VulnerableZend
cpe:2.3:a:zend:zend_framework:1.9.4:*:*:*:*:*:*:*1.9.4VulnerableZend
cpe:2.3:a:zend:zend_framework:1.9.5:*:*:*:*:*:*:*1.9.5VulnerableZend
cpe:2.3:a:zend:zend_framework:1.9.6:*:*:*:*:*:*:*1.9.6VulnerableZend
cpe:2.3:a:zend:zend_framework:1.9.7:*:*:*:*:*:*:*1.9.7VulnerableZend
cpe:2.3:a:zend:zend_framework:1.9.8:*:*:*:*:*:*:*1.9.8VulnerableZend
cpe:2.3:a:zend:zend_framework:1.10.0:*:*:*:*:*:*:*1.10.0VulnerableZend
cpe:2.3:a:zend:zend_framework:1.10.1:*:*:*:*:*:*:*1.10.1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.10.2:*:*:*:*:*:*:*1.10.2VulnerableZend
cpe:2.3:a:zend:zend_framework:1.10.3:*:*:*:*:*:*:*1.10.3VulnerableZend
cpe:2.3:a:zend:zend_framework:1.10.4:*:*:*:*:*:*:*1.10.4VulnerableZend
cpe:2.3:a:zend:zend_framework:1.10.5:*:*:*:*:*:*:*1.10.5VulnerableZend
cpe:2.3:a:zend:zend_framework:1.10.6:*:*:*:*:*:*:*1.10.6VulnerableZend
cpe:2.3:a:zend:zend_framework:1.10.7:*:*:*:*:*:*:*1.10.7VulnerableZend
cpe:2.3:a:zend:zend_framework:1.10.8:*:*:*:*:*:*:*1.10.8VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.0:*:*:*:*:*:*:*1.11.0VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.1:*:*:*:*:*:*:*1.11.1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.2:*:*:*:*:*:*:*1.11.2VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.3:*:*:*:*:*:*:*1.11.3VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.4:*:*:*:*:*:*:*1.11.4VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.5:*:*:*:*:*:*:*1.11.5VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.6:*:*:*:*:*:*:*1.11.6VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.7:*:*:*:*:*:*:*1.11.7VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.8:*:*:*:*:*:*:*1.11.8VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.9:*:*:*:*:*:*:*1.11.9VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.10:*:*:*:*:*:*:*1.11.10VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.11:*:*:*:*:*:*:*1.11.11VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.12:*:*:*:*:*:*:*1.11.12VulnerableZend
cpe:2.3:a:zend:zend_framework:1.12.0:rc1:*:*:*:*:*:*1.12.0 rc1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.12.0:rc2:*:*:*:*:*:*1.12.0 rc2VulnerableZend
cpe:2.3:a:zend:zend_framework:1.12.0:rc3:*:*:*:*:*:*1.12.0 rc3VulnerableZend
cpe:2.3:a:zend:zend_framework:1.12.0:rc4:*:*:*:*:*:*1.12.0 rc4VulnerableZend
  • cpe:2.3:a:zend:zend_framework:1.7.2:*:*:*:*:*:*:* Versions 1.7.2 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.7.3:*:*:*:*:*:*:* Versions 1.7.3 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.7.4:*:*:*:*:*:*:* Versions 1.7.4 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.7.5:*:*:*:*:*:*:* Versions 1.7.5 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.7.6:*:*:*:*:*:*:* Versions 1.7.6 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.7.7:*:*:*:*:*:*:* Versions 1.7.7 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.7.8:*:*:*:*:*:*:* Versions 1.7.8 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.7.9:*:*:*:*:*:*:* Versions 1.7.9 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.8.0:*:*:*:*:*:*:* Versions 1.8.0 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.8.1:*:*:*:*:*:*:* Versions 1.8.1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.8.2:*:*:*:*:*:*:* Versions 1.8.2 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.8.3:*:*:*:*:*:*:* Versions 1.8.3 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.8.4:*:*:*:*:*:*:* Versions 1.8.4 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.8.5:*:*:*:*:*:*:* Versions 1.8.5 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.9.0:*:*:*:*:*:*:* Versions 1.9.0 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.9.1:*:*:*:*:*:*:* Versions 1.9.1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.9.2:*:*:*:*:*:*:* Versions 1.9.2 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.9.3:*:*:*:*:*:*:* Versions 1.9.3 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.9.4:*:*:*:*:*:*:* Versions 1.9.4 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.9.5:*:*:*:*:*:*:* Versions 1.9.5 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.9.6:*:*:*:*:*:*:* Versions 1.9.6 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.9.7:*:*:*:*:*:*:* Versions 1.9.7 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.9.8:*:*:*:*:*:*:* Versions 1.9.8 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.10.0:*:*:*:*:*:*:* Versions 1.10.0 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.10.1:*:*:*:*:*:*:* Versions 1.10.1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.10.2:*:*:*:*:*:*:* Versions 1.10.2 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.10.3:*:*:*:*:*:*:* Versions 1.10.3 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.10.4:*:*:*:*:*:*:* Versions 1.10.4 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.10.5:*:*:*:*:*:*:* Versions 1.10.5 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.10.6:*:*:*:*:*:*:* Versions 1.10.6 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.10.7:*:*:*:*:*:*:* Versions 1.10.7 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.10.8:*:*:*:*:*:*:* Versions 1.10.8 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.0:*:*:*:*:*:*:* Versions 1.11.0 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.1:*:*:*:*:*:*:* Versions 1.11.1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.2:*:*:*:*:*:*:* Versions 1.11.2 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.3:*:*:*:*:*:*:* Versions 1.11.3 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.4:*:*:*:*:*:*:* Versions 1.11.4 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.5:*:*:*:*:*:*:* Versions 1.11.5 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.6:*:*:*:*:*:*:* Versions 1.11.6 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.7:*:*:*:*:*:*:* Versions 1.11.7 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.8:*:*:*:*:*:*:* Versions 1.11.8 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.9:*:*:*:*:*:*:* Versions 1.11.9 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.10:*:*:*:*:*:*:* Versions 1.11.10 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.11:*:*:*:*:*:*:* Versions 1.11.11 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.12:*:*:*:*:*:*:* Versions 1.11.12 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.12.0:rc1:*:*:*:*:*:* Versions 1.12.0 rc1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.12.0:rc2:*:*:*:*:*:* Versions 1.12.0 rc2 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.12.0:rc3:*:*:*:*:*:* Versions 1.12.0 rc3 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.12.0:rc4:*:*:*:*:*:* Versions 1.12.0 rc4 Vulnerable ·Zend

Remediation

  • Fix · GHSA-h5p3-7mg6-hgj4 zendframework/zendframework1 (Packagist) Fixed in 1.11.13 Advisory →
  • Fix · GHSA-h5p3-7mg6-hgj4 zendframework/zendframework1 (Packagist) Fixed in 1.12.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2012-6531
  2. 2026-10-03 Alias added: GHSA-h5p3-7mg6-hgj4

References

Advisory 3

Other 6

  • TI-2021-02150 Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a… CVSS 3.1CRITICAL 9.8
  • TI-2012-02894 Zend_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not… CVSS 3.1CRITICAL 9.1
  • TI-2016-08119 The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11… CVSS 3.0CRITICAL 9.8
  • TI-2020-17638 An issue found in Zend Framework v.3.1.3 and before allow a remote attacker to execute… CVSS 3.1CRITICAL 9.8
  • TI-2016-04204 The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before… CVSS 3.0CRITICAL 9.8
  • TI-2011-01711 SQL injection in zendframework;PHP zendframework CVSS 3.1CRITICAL 9.8
See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences