ZendXml and Zend Framework contain XXE and XEE Vulnerabilities
Date: 2022-05
Affected: composer/zendframework/zendframework, composer/zendframework/zendxml, composer/zendframework/zendframework1
Attack vector: other
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2015-5161
CWE: CWE-611
CWE-776

The `Zend_Xml_Security::scan` in ZendXml before 1.0.1 and Zend Framework before 1.12.14, 2.x before 2.4.6, and 2.5.x before 2.5.2, when running under PHP-FPM in a threaded environment, allows remote attackers to bypass security checks and conduct XML external entity (XXE) and XML entity expansion (XEE) attacks via multibyte encoded characters.


Mitigations:

Architectural layers (MAESTRO):