CVE-2014-2681: Several Zend Products Vulnerable to XXE and XEE attacks
Several Zend Products Vulnerable to XXE and XEE attacks
Other sources
Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendServiceAudioScrobbler, ZendServiceNirvanix, ZendServiceSlideShare, ZendServiceTechnorati, and ZendServiceWindowsAzure before 2.0.2, ZendServiceAmazon before 2.0.3, and ZendServiceApi before 1.0.0 allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, and possibly cause a denial of service (CPU and memory consumption) via an XML External Entity (XXE) attack. NOTE: this issue exists because of an incomplete fix for CVE-2012-5657.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/zendframework/zendservice-apito a version that resolves this vulnerability.Fixed in 1.0.0 - Upgrade
Upgrade
composer/zendframework/zendservice-amazonto a version that resolves this vulnerability.Fixed in 2.0.3 - Upgrade
Upgrade
composer/zendframework/zendservice-windowsazureto a version that resolves this vulnerability.Fixed in 2.0.2 - Upgrade
Upgrade
composer/zendframework/zendservice-technoratito a version that resolves this vulnerability.Fixed in 2.0.2 - Upgrade
Upgrade
composer/zendframework/zendservice-slideshareto a version that resolves this vulnerability.Fixed in 2.0.2 - Upgrade
Upgrade
composer/zendframework/zendservice-nirvanixto a version that resolves this vulnerability.Fixed in 2.0.2 - Upgrade
Upgrade
composer/zendframework/zendservice-audioscrobblerto a version that resolves this vulnerability.Fixed in 2.0.2 - Upgrade
Upgrade
composer/zendframework/zendrestto a version that resolves this vulnerability.Fixed in 2.0.2 - Upgrade
Upgrade
composer/zendframework/zendopenidto a version that resolves this vulnerability.Fixed in 2.0.2 - Upgrade
Upgrade
composer/zendframework/zendframework1to a version that resolves this vulnerability.Fixed in 1.12.4 - Upgrade
Upgrade
Zend Framework 1 (ZF1)to a version that resolves this vulnerability.Fixed in 1.12.4 - Upgrade
Upgrade
Zend Framework 2 (ZF2) 2.1.xto a version that resolves this vulnerability.Fixed in 2.1.6 - Upgrade
Upgrade
Zend Framework 2 (ZF2) 2.2.xto a version that resolves this vulnerability.Fixed in 2.2.6 - Upgrade
Upgrade
ZendOpenId; ZendRest; ZendService_AudioScrobbler; ZendService_Nirvanix; ZendService_SlideShare; ZendService_Technorati; ZendService_WindowsAzureto a version that resolves this vulnerability.Fixed in 2.0.2 - Upgrade
Upgrade
ZendService_Amazonto a version that resolves this vulnerability.Fixed in 2.0.3 - Upgrade
Upgrade
ZendService_Apito a version that resolves this vulnerability.Fixed in 1.0.0
Event History
Frequently Asked Questions
What is the severity of CVE-2014-2681?
CVE-2014-2681 is classified as a moderate severity vulnerability in various versions of Zend Framework.
How do I fix CVE-2014-2681?
To mitigate CVE-2014-2681, upgrade to Zend Framework version 1.12.4 or 2.1.6 and above, or ensure you're using the latest versions of the affected Zend services.
What software is affected by CVE-2014-2681?
CVE-2014-2681 affects numerous versions of Zend Framework, ZendRest, and various ZendService components.
Is CVE-2014-2681 exploitable?
Yes, CVE-2014-2681 is exploitable if the affected software is deployed without applying recommended security updates.
What are the implications of CVE-2014-2681?
The implications of CVE-2014-2681 may include security risks such as data exposure due to insufficient verification mechanisms in affected Zend components.