NewApp Monitoring is liveSign up free
AgentbeamBeta
Open-source package vulnerability · Composer (PHP)

GHSA-mhpx-3rv8-wrjm: ZendFramework potential XML eXternal Entity injection vectors

criticalCVSS 3.1 9.8

Numerous components utilizing PHP's DOMDocument, SimpleXML, and xmlparse functionality are vulnerable to two types of attacks: - XML eXternal Entity (XXE) Injection attacks. The above mentioned extensions are insecure by default, allowing external entities to be specified by adding a specific DOCTYPE element to XML documents and strings.

Published Jun 7, 2024

Affected packages

zendframework/zendframework1

Ecosystem
Composer (PHP)
Affected
>= 1.12.0, < 1.12.4
Fixed in
1.12.4
Check
composer show zendframework/zendframework1

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Numerous components utilizing PHP's DOMDocument, SimpleXML, and xml_parse functionality are vulnerable to two types of attacks:

  • XML eXternal Entity (XXE) Injection attacks. The above mentioned extensions are insecure by default, allowing external entities to be specified by adding a specific DOCTYPE element to XML documents and strings. By exploiting this vulnerability an application may be coerced to open arbitrary files and/or TCP connections.
  • XML Entity Expansion (XEE) vectors, leading to Denial of Service vectors. XEE attacks occur when the XML DOCTYPE declaration includes XML entity definitions that contain either recursive or circular references; this leads to CPU and memory consumption, making Denial of Service exploits trivial to implement.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Composer (PHP) vulnerabilities

All Composer (PHP) entries