Lucene search

[email protected]NVD:CVE-2014-2683

HistoryNov 16, 2014 - 12:59 a.m.

CVE-2014-2683

2014-11-1600:59:03

CWE-17

[email protected]

web.nvd.nist.gov

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

AI Score

9.3

Confidence

High

EPSS

0.013

Percentile

86.1%

JSON

Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0 allow remote attackers to cause a denial of service (CPU consumption) via (1) recursive or (2) circular references in an XML entity definition in an XML DOCTYPE declaration, aka an XML Entity Expansion (XEE) attack. NOTE: this issue exists because of an incomplete fix for CVE-2012-6532.

Affected configurations

Nvd

Node

zendzendrestRange≤2.0.1

Node

zendzend_frameworkRange<1.12.4

zendzend_frameworkRange2.1.0–2.1.6

zendzend_frameworkRange2.2.0–2.2.6

Node

zendzendservice_slideshareRange≤2.0.1

Node

zendzendservice_apiRange≤1.0.0

Node

zendzendservice_audioscrobblerRange≤2.0.1

Node

zendzendservice_amazonRange≤2.0.2

Node

zendzendservice_technoratiRange≤2.0.1

Node

zendzendservice_windowsazureRange≤2.0.1

Node

zendzendopenidRange≤2.0.1

Node

zendzendservice_nirvanixRange≤2.0.1

VendorProductVersionCPE
zendzendrest*cpe:2.3:a:zend:zendrest:*:*:*:*:*:*:*:*
zendzend_framework*cpe:2.3:a:zend:zend_framework:*:*:*:*:*:*:*:*
zendzendservice_slideshare*cpe:2.3:a:zend:zendservice_slideshare:*:*:*:*:*:*:*:*
zendzendservice_api*cpe:2.3:a:zend:zendservice_api:*:*:*:*:*:*:*:*
zendzendservice_audioscrobbler*cpe:2.3:a:zend:zendservice_audioscrobbler:*:*:*:*:*:*:*:*
zendzendservice_amazon*cpe:2.3:a:zend:zendservice_amazon:*:*:*:*:*:*:*:*
zendzendservice_technorati*cpe:2.3:a:zend:zendservice_technorati:*:*:*:*:*:*:*:*
zendzendservice_windowsazure*cpe:2.3:a:zend:zendservice_windowsazure:*:*:*:*:*:*:*:*
zendzendopenid*cpe:2.3:a:zend:zendopenid:*:*:*:*:*:*:*:*
zendzendservice_nirvanix*cpe:2.3:a:zend:zendservice_nirvanix:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
zend	zendrest	*	cpe:2.3:a:zend:zendrest::::::::
zend	zend_framework	*	cpe:2.3:a:zend:zend_framework::::::::
zend	zendservice_slideshare	*	cpe:2.3:a:zend:zendservice_slideshare::::::::
zend	zendservice_api	*	cpe:2.3:a:zend:zendservice_api::::::::
zend	zendservice_audioscrobbler	*	cpe:2.3:a:zend:zendservice_audioscrobbler::::::::
zend	zendservice_amazon	*	cpe:2.3:a:zend:zendservice_amazon::::::::
zend	zendservice_technorati	*	cpe:2.3:a:zend:zendservice_technorati::::::::
zend	zendservice_windowsazure	*	cpe:2.3:a:zend:zendservice_windowsazure::::::::
zend	zendopenid	*	cpe:2.3:a:zend:zendopenid::::::::
zend	zendservice_nirvanix	*	cpe:2.3:a:zend:zendservice_nirvanix::::::::