{"id":"CVE-2012-4399","aliases":["EUVD-2022-2545","GHSA-5964-pq8r-4q62"],"status":"published","title":"CakePHPallows remote attackers to read arbitrary files via XML data containing external entity references","description":"The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.12091,"percentile":0.96173,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-611"],"published":"2012-10-09T23:00:00Z","modified":"2026-06-16T23:44:56Z","exploits":[{"source":"exploitdb","id":"EDB-19863","title":"CakePHP 2.x \u003c 2.2.0-RC2 - XML External Entity Injection","type":"webapps","platform":"php","date":"2012-07-16","verified":true,"url":"https://www.exploit-db.com/exploits/19863"}],"fixes":[{"ecosystem":"Packagist","package":"cakephp/cakephp","fixed_in":["2.1.5","2.2.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"cakephp/cakephp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0-alpha"},{"fixed":"2.1.5"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"cakephp/cakephp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0-beta"},{"fixed":"2.2.1"}]}]},{"source":"osv","ecosystem":"Packagist","package":"cakephp/cakephp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0-alpha"},{"fixed":"2.1.5"}]}]},{"source":"osv","ecosystem":"Packagist","package":"cakephp/cakephp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0-beta"},{"fixed":"2.2.1"}]}]}],"products":[{"vendor":"cakefoundation","product":"cakephp"}],"references":[{"url":"http://secunia.com/advisories/49900","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Vendor Advisory","web"]},{"url":"http://seclists.org/bugtraq/2012/Jul/101","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Exploit","Mailing List","Third Party Advisory","web"]},{"url":"http://bakery.cakephp.org/articles/markstory/2012/07/14/security_release_-_cakephp_2_1_5_2_2_1","tags":["x_refsource_CONFIRM","x_transferred","Broken Link","Vendor Advisory","web"]},{"url":"http://www.exploit-db.com/exploits/19863","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry","web"]},{"url":"http://www.osvdb.org/84042","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","Broken Link","web"]},{"url":"http://www.openwall.com/lists/oss-security/2012/09/03/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","web"]},{"url":"http://www.openwall.com/lists/oss-security/2012/09/03/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-4399","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-5964-pq8r-4q62"},{"url":"https://github.com/cakephp/cakephp","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2012-4399","description":"The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.","status":"published","published":"2012-10-09T23:00:00Z","modified":"2024-09-16T17:14:37.653Z","updated_at":"2026-11-02T14:34:51.937988Z"}],"euvd":[{"id":"EUVD-2022-2545","description":"The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.","status":"published","published":"2012-10-09T23:00:00Z","modified":"2024-09-16T17:14:37Z","updated_at":"2026-11-03T00:55:44.31512Z"}],"ghsa":[{"id":"GHSA-5964-pq8r-4q62","title":"CakePHPallows remote attackers to read arbitrary files via XML data containing external entity references","description":"The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.","status":"published","published":"2022-05-17T05:07:14Z","modified":"2024-04-09T14:17:44Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:37:42.744468Z"}],"nvd":[{"id":"CVE-2012-4399","description":"The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.","status":"published","published":"2012-10-09T23:55:05.047Z","modified":"2026-06-16T23:44:56.67Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:02:16.115119Z"}],"osv":[{"id":"GHSA-5964-pq8r-4q62","title":"CakePHPallows remote attackers to read arbitrary files via XML data containing external entity references","description":"The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.","status":"published","published":"2022-05-17T05:07:14Z","modified":"2024-04-09T14:17:43Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:46:38.213481Z"}]}}