CVE-2015-5161

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 9.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2015-08-25 · updated 2026-06-17

Description

The Zend_Xml_Security::scan in ZendXml before 1.0.1 and Zend Framework before 1.12.14, 2.x before 2.4.6, and 2.5.x before 2.5.2, when running under PHP-FPM in a threaded environment, allows remote attackers to bypass security checks and conduct XML external entity (XXE) and XML entity expansion (XEE) attacks via multibyte encoded characters.

Affected products

Zend Technologies Zend Framework: 1.0.0, 1.0.0-rc1, 1.0.0-rc2, 1.0.0-rc2a, 1.0.0-rc3, 1.0.1 (+148)

References

http://framework.zend.com/security/advisory/ZF2015-06
http://legalhackers.com/advisories/zend-framework-XXE-vuln.txt
http://lists.fedoraproject.org/pipermail/package-announce/2015-August/164409.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165147.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165173.html
http://packetstormsecurity.com/files/133068/Zend-Framework-2.4.2-1.12.13-XXE-Injection.html
http://seclists.org/fulldisclosure/2015/Aug/46
http://www.debian.org/security/2015/dsa-3340
http://www.securityfocus.com/bid/76177
https://www.exploit-db.com/exploits/37765/
http://framework.zend.com/security/advisory/ZF2015-06
http://legalhackers.com/advisories/zend-framework-XXE-vuln.txt

Get alerted when CVE-2015-5161 or the next vulnerability affects your stack