CVE-2014-2682: Several Zend Products Vulnerable to XXE and XEE attacks

CVE-2014-2682 · Severity: info · Published 2022-05-14

Several Zend Products Vulnerable to XXE and XEE attacks

Technologies: zendframework/zendframework1 (Packagist), zendframework/zendopenid (Packagist), zendframework/zendrest (Packagist), zendframework/zendservice-amazon (Packagist), zendframework/zendservice-api (Packagist), zendframework/zendservice-audioscrobbler (Packagist), zendframework/zendservice-nirvanix (Packagist), zendframework/zendservice-slideshare (Packagist), zendframework/zendservice-technorati (Packagist), zendframework/zendservice-windowsazure (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2014-2682 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2014-2682 being exploited in the wild.
How severe is CVE-2014-2682?
Informational severity, published 14 May 2022.
Which products and versions are affected?
zendframework/zendframework1 (Packagist) ECOSYSTEM:introduced=0,fixed=1.12.4; zendframework/zendopenid (Packagist) ECOSYSTEM:introduced=0,fixed=2.0.2; zendframework/zendrest (Packagist) ECOSYSTEM:introduced=0,fixed=2.0.2; zendframework/zendservice-amazon (Packagist) ECOSYSTEM:introduced=0,fixed=2.0.3; and 6 more.
Is there a fix for CVE-2014-2682?
Yes. zendframework/zendframework1 (Packagist): upgrade to 1.12.4 or later; zendframework/zendopenid (Packagist): upgrade to 2.0.2 or later; zendframework/zendrest (Packagist): upgrade to 2.0.2 or later; zendframework/zendservice-amazon (Packagist): upgrade to 2.0.3 or later; zendframework/zendservice-api (Packagist): upgrade to 1.0.0 or later; zendframework/zendservice-audioscrobbler (Packagist): upgrade to 2.0.2 or later; zendframework/zendservice-nirvanix (Packagist): upgrade to 2.0.2 or later; zendframework/zendservice-slideshare (Packagist): upgrade to 2.0.2 or later; zendframework/zendservice-technorati (Packagist): upgrade to 2.0.2 or later; zendframework/zendservice-windowsazure (Packagist): upgrade to 2.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2014-2682?
Check whether you run zendframework/zendframework1 (Packagist), zendframework/zendopenid (Packagist), zendframework/zendrest (Packagist) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • zendframework/zendframework1 (Packagist): upgrade to 1.12.4 or later
    composer require zendframework/zendframework1:^1.12.4
  • zendframework/zendopenid (Packagist): upgrade to 2.0.2 or later
    composer require zendframework/zendopenid:^2.0.2
  • zendframework/zendrest (Packagist): upgrade to 2.0.2 or later
    composer require zendframework/zendrest:^2.0.2
  • zendframework/zendservice-amazon (Packagist): upgrade to 2.0.3 or later
    composer require zendframework/zendservice-amazon:^2.0.3
  • zendframework/zendservice-api (Packagist): upgrade to 1.0.0 or later
    composer require zendframework/zendservice-api:^1.0.0
  • zendframework/zendservice-audioscrobbler (Packagist): upgrade to 2.0.2 or later
    composer require zendframework/zendservice-audioscrobbler:^2.0.2
  • zendframework/zendservice-nirvanix (Packagist): upgrade to 2.0.2 or later
    composer require zendframework/zendservice-nirvanix:^2.0.2
  • zendframework/zendservice-slideshare (Packagist): upgrade to 2.0.2 or later
    composer require zendframework/zendservice-slideshare:^2.0.2
  • zendframework/zendservice-technorati (Packagist): upgrade to 2.0.2 or later
    composer require zendframework/zendservice-technorati:^2.0.2
  • zendframework/zendservice-windowsazure (Packagist): upgrade to 2.0.2 or later
    composer require zendframework/zendservice-windowsazure:^2.0.2

Affected products

  • zendframework/zendframework1 (Packagist) ECOSYSTEM:introduced=0,fixed=1.12.4
  • zendframework/zendopenid (Packagist) ECOSYSTEM:introduced=0,fixed=2.0.2
  • zendframework/zendrest (Packagist) ECOSYSTEM:introduced=0,fixed=2.0.2
  • zendframework/zendservice-amazon (Packagist) ECOSYSTEM:introduced=0,fixed=2.0.3
  • zendframework/zendservice-api (Packagist) ECOSYSTEM:introduced=0,fixed=1.0.0
  • zendframework/zendservice-audioscrobbler (Packagist) ECOSYSTEM:introduced=0,fixed=2.0.2
  • zendframework/zendservice-nirvanix (Packagist) ECOSYSTEM:introduced=0,fixed=2.0.2
  • zendframework/zendservice-slideshare (Packagist) ECOSYSTEM:introduced=0,fixed=2.0.2
  • zendframework/zendservice-technorati (Packagist) ECOSYSTEM:introduced=0,fixed=2.0.2
  • zendframework/zendservice-windowsazure (Packagist) ECOSYSTEM:introduced=0,fixed=2.0.2

Identifiers

  • CVE-2014-2682
  • GHSA-gp39-h9c2-qw79

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.