{"id":"CVE-2012-4399","url":"https://www.cyber-defence.io/tools/cve/CVE-2012-4399","generatedAt":"2026-11-05T08:05:30.616Z","title":"The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.","description":"The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.","published":"2012-10-09T23:55:05.000Z","lastModified":"2026-06-16T23:44:57.000Z","status":"Modified","sourceIdentifier":"secalert@redhat.com","cvss":{"version":"3.1","score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"cwe":["CWE-611"],"affected":["cakefoundation/cakephp"],"epss":{"score":0.12091,"percentile":0.96159,"date":"2026-11-04","history":[]},"kev":{"listed":false},"exploits":{"count":1,"verified":true,"firstPublished":"2012-07-16","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":19863,"kind":"exploit","title":"CakePHP 2.x < 2.2.0-RC2 - XML External Entity Injection","url":"https://www.exploit-db.com/exploits/19863","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/19863.txt","file":"exploits/php/webapps/19863.txt","published":"2012-07-16","added":"2012-07-16","updated":"2017-11-02","author":"Pawel Wylecial","type":"webapps","platform":"php","port":null,"verified":true,"codes":["OSVDB-84042","CVE-2012-4399"],"tags":null,"aliases":null,"applicationUrl":"http://www.exploit-db.comcakephp-cakephp-2.2.0-beta-0-gf14f18f.zip","screenshotUrl":null,"referenceUrl":null}]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 12.1%, higher than 96% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"http://bakery.cakephp.org/articles/markstory/2012/07/14/security_release_-_cakephp_2_1_5_2_2_1","tags":["Broken Link","Vendor Advisory"],"source":"secalert@redhat.com"},{"url":"http://seclists.org/bugtraq/2012/Jul/101","tags":["Exploit","Mailing List","Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/49900","tags":["Broken Link","Vendor Advisory"],"source":"secalert@redhat.com"},{"url":"http://www.exploit-db.com/exploits/19863","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"secalert@redhat.com"},{"url":"http://www.openwall.com/lists/oss-security/2012/09/03/1","tags":["Mailing List"],"source":"secalert@redhat.com"},{"url":"http://www.openwall.com/lists/oss-security/2012/09/03/2","tags":["Mailing List"],"source":"secalert@redhat.com"},{"url":"http://www.osvdb.org/84042","tags":["Broken Link"],"source":"secalert@redhat.com"},{"url":"http://bakery.cakephp.org/articles/markstory/2012/07/14/security_release_-_cakephp_2_1_5_2_2_1","tags":["Broken Link","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://seclists.org/bugtraq/2012/Jul/101","tags":["Exploit","Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/49900","tags":["Broken Link","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.exploit-db.com/exploits/19863","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2012/09/03/1","tags":["Mailing List"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2012/09/03/2","tags":["Mailing List"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.osvdb.org/84042","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2012-4399","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}