What’s Vulnerable › Vulnerabilities

CVE-2012-6685

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-02-19 · updated 2026-06-16
• Weakness: CWE-776

Description

Nokogiri before 1.5.4 is vulnerable to XXE attacks

Affected products

• sparklemotion nokogiri: before 1.5.4 — fixed in 1.5.4
• Red Hat CloudForms: 5.0
• RedHat Enterprise Mrg: 2.0
• Openshift: 2.0
• OpenStack: 4.0, 6.0
• RedHat Openstack Foreman: all versions
• Red Hat Satellite 6: 6.0
• RedHat Subscription Asset Manager: all versions

How to fix

Upgrade to a fixed version: sparklemotion nokogiri 1.5.4. Check the vendor advisory for mitigations.

References

• https://bugzilla.redhat.com/show_bug.cgi?id=1178970
• https://github.com/sparklemotion/nokogiri/issues/693
• https://nokogiri.org/CHANGELOG.html#154-2012-06-12
• https://bugzilla.redhat.com/show_bug.cgi?id=1178970
• https://github.com/sparklemotion/nokogiri/issues/693
• https://nokogiri.org/CHANGELOG.html#154-2012-06-12

Get alerted when CVE-2012-6685 or the next vulnerability affects your stack