CVE

Id
69976  
CVE No.
CVE-2014-2681  
Status
Candidate  
Description
Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0 allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, and possibly cause a denial of service (CPU and memory consumption) via an XML External Entity (XXE) attack. NOTE: this issue exists because of an incomplete fix for CVE-2012-5657.  
Phase
Assigned (20140330)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
668049 69976 CVE-2014-2681 MLIST:[oss-security] 20140331 Re: CVE requests: Zend Framework issues fixed in ZF2014-01 and ZF2014-02  View
668050 69976 CVE-2014-2681 URL:http://seclists.org/oss-sec/2014/q2/0  View
668051 69976 CVE-2014-2681 CONFIRM:http://advisories.mageia.org/MGASA-2014-0151.html  View
668052 69976 CVE-2014-2681 CONFIRM:http://framework.zend.com/security/advisory/ZF2014-01  View
668053 69976 CVE-2014-2681 MANDRIVA:MDVSA-2014:072  View
668054 69976 CVE-2014-2681 URL:http://www.mandriva.com/security/advisories?name=MDVSA-2014:072  View
668055 69976 CVE-2014-2681 BID:66358  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
13562 JVNDB-2014-002437 Offiria におけるクロスサイトスクリプティングの脆弱性 Offiria には、クロスサイトスクリプティングの脆弱性が存在します。 CVE-2014-2689 69976 4.3 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-002437.html  View