Lucene search

[email protected]NVD:CVE-2014-2682

HistoryNov 16, 2014 - 12:59 a.m.

CVE-2014-2682

2014-11-1600:59:02

CWE-19

[email protected]

web.nvd.nist.gov

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

9.6

Confidence

High

EPSS

0.006

Percentile

78.6%

JSON

Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0, when PHP-FPM is used, does not properly share the libxml_disable_entity_loader setting between threads, which might allow remote attackers to conduct XML External Entity (XXE) attacks via an XML external entity declaration in conjunction with an entity reference. NOTE: this issue exists because of an incomplete fix for CVE-2012-5657.

Affected configurations

Nvd

Node

zendzendrestRange≤2.0.1

Node

zendzend_frameworkRange<1.12.4

zendzend_frameworkRange2.1.0–2.1.6

zendzend_frameworkRange2.2.0–2.2.6

Node

zendzendservice_slideshareRange≤2.0.1

Node

zendzendservice_apiRange≤1.0.0

Node

zendzendservice_audioscrobblerRange≤2.0.1

Node

zendzendservice_amazonRange≤2.0.2

Node

zendzendservice_technoratiRange≤2.0.1

Node

zendzendservice_windowsazureRange≤2.0.1

Node

zendzendopenidRange≤2.0.1

Node

zendzendservice_nirvanixRange≤2.0.1

VendorProductVersionCPE
zendzendrest*cpe:2.3:a:zend:zendrest:*:*:*:*:*:*:*:*
zendzend_framework*cpe:2.3:a:zend:zend_framework:*:*:*:*:*:*:*:*
zendzendservice_slideshare*cpe:2.3:a:zend:zendservice_slideshare:*:*:*:*:*:*:*:*
zendzendservice_api*cpe:2.3:a:zend:zendservice_api:*:*:*:*:*:*:*:*
zendzendservice_audioscrobbler*cpe:2.3:a:zend:zendservice_audioscrobbler:*:*:*:*:*:*:*:*
zendzendservice_amazon*cpe:2.3:a:zend:zendservice_amazon:*:*:*:*:*:*:*:*
zendzendservice_technorati*cpe:2.3:a:zend:zendservice_technorati:*:*:*:*:*:*:*:*
zendzendservice_windowsazure*cpe:2.3:a:zend:zendservice_windowsazure:*:*:*:*:*:*:*:*
zendzendopenid*cpe:2.3:a:zend:zendopenid:*:*:*:*:*:*:*:*
zendzendservice_nirvanix*cpe:2.3:a:zend:zendservice_nirvanix:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
zend	zendrest	*	cpe:2.3:a:zend:zendrest::::::::
zend	zend_framework	*	cpe:2.3:a:zend:zend_framework::::::::
zend	zendservice_slideshare	*	cpe:2.3:a:zend:zendservice_slideshare::::::::
zend	zendservice_api	*	cpe:2.3:a:zend:zendservice_api::::::::
zend	zendservice_audioscrobbler	*	cpe:2.3:a:zend:zendservice_audioscrobbler::::::::
zend	zendservice_amazon	*	cpe:2.3:a:zend:zendservice_amazon::::::::
zend	zendservice_technorati	*	cpe:2.3:a:zend:zendservice_technorati::::::::
zend	zendservice_windowsazure	*	cpe:2.3:a:zend:zendservice_windowsazure::::::::
zend	zendopenid	*	cpe:2.3:a:zend:zendopenid::::::::
zend	zendservice_nirvanix	*	cpe:2.3:a:zend:zendservice_nirvanix::::::::