CVE-2012-6685

24

FAUCET Score

CVE-2012-6685 describes an XML External Entity (XXE) vulnerability in Nokogiri versions prior to 1.5.4, also affecting Red Hat products utilizing these vulnerable Nokogiri versions. This high-severity vulnerability, with a CVSS score of 7.5, allows for unauthenticated remote attacks with low complexity, potentially leading to significant information disclosure. Despite its age and high severity, there is no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this CVE.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		< 1.5.4CPE matchmatch criteria	cpe:2.3:a:nokogiri:nokogiri::::::::
		5.0CPE matchmatch criteria	cpe:2.3:a:redhat:cloudforms_management_engine:5.0:::::::*
		2.0CPE matchmatch criteria	cpe:2.3:a:redhat:openshift:2.0::::enterprise:::
		4.0CPE matchmatch criteria	cpe:2.3:a:redhat:openstack:4.0:::::::*
		6.0CPE matchmatch criteria	cpe:2.3:a:redhat:openstack:6.0:::::::*

CVSS Data

CVSS version used by this source: 3.1

7.5HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

Exploitability Score

3.9

Impact Score

3.6

CvssVersion

3.1

Exploit Intelligence

EPSS Score

2.17%

Probability of exploitation in next 30 days

EPSS Percentile

80.4%

Percentile rank of EPSS score among Peer Group

As of 2026-07-24

Model: v2026.06.15

This CVE's current EPSS score of 0.0217 is in the 65th percentile among its peer group of 51,466 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (86)

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: rubygem-puma-0:3.7.1-1.el7cf

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: ovirt-ansible-engine-setup-0:1.1.5-1.el7ev

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: rabbitmq-server-0:3.7.4-1.el7at

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: ansible-runner-0:1.1.2-2.el7ar

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: ansible-tower-0:3.3.3-1.el7at

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: bubblewrap-0:0.1.7-1.el7

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: cfme-0:5.10.0.33-1.el7cf

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: cfme-amazon-smartstate-0:5.10.0.33-1.el7cf

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: cfme-appliance-0:5.10.0.33-1.el7cf

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: cfme-gemset-0:5.10.0.33-1.el7cf

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: dbus-api-service-0:1.0.1-5.el7cf

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: dumb-init-0:1.2.0-1.el7cf

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: erlang-0:19.3.6.7-1.el7at

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: google-compute-engine-0:2.0.0-2.el7cf

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: google-config-0:2.0.0-2.el7cf

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: httpd-configmap-generator-0:0.2.2-2.el7cf

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: nginx-1:1.10.2-1.el7at

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: ovirt-ansible-cluster-upgrade-0:1.1.8-1.el7ev

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: ovirt-ansible-disaster-recovery-0:1.1.2-1.el7ev

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: ovirt-ansible-image-template-0:1.1.8-1.el7ev

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: ovirt-ansible-infra-0:1.1.8-1.el7ev

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: ovirt-ansible-manageiq-0:1.1.12-1.el7ev

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: ovirt-ansible-repositories-0:1.1.2-1.el7ev

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: ovirt-ansible-roles-0:1.1.5-1.el7ev

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: ovirt-ansible-shutdown-env-0:1.0.0-1.el7ev

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: ovirt-ansible-v2v-conversion-host-0:1.6.3-1.el7ev

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: ovirt-ansible-vm-infra-0:1.1.10-1.el7ev

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: postgresql96-0:9.6.10-1PGDG.el7at

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: prince-0:9.0r2-10.el7cf

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: pyOpenSSL-0:17.3.0-4.el7ost

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: python-bambou-0:3.0.1-2.el7cf

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: python-colorama-0:0.3.7-2.el7ost

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: python-crypto-0:2.6.1-16.el7at

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: python-daemon-0:2.1.2-7.el7at

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: python-funcsigs-0:1.0.2-1.el7ost

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: python-future-0:0.16.0-1.el7cf

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: python-lockfile-1:0.11.0-10.el7at

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: python-meld3-0:0.6.10-1.el7

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: python-mock-0:2.0.0-1.el7ost

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: python-pbr-0:3.1.1-2.el7ost

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: python-pexpect-0:4.6-1.el7at

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: python-psutil-0:5.4.3-2.el7at

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: python-ptyprocess-0:0.5.2-3.el7at

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: python-pylxca-0:2.1.1-2.el7cf

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: python-pysocks-0:1.5.6-3.el7ost

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: python-requests-0:2.14.2-1.el7ost

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: python-requests-toolbelt-0:0.8.0-2.el7cf

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: python-tabulate-0:0.8.2-1.el7cf

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: python-urllib3-0:1.21.1-1.2.el7ost

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: python-vspk-0:5.3.2-2.el7cf

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: qpid-proton-0:0.19.0-1.el7cf

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: rh-postgresql95-postgresql-pglogical-0:2.1.0-4.el7cf

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: rh-postgresql95-repmgr-0:4.0.6-2.el7cf

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: ruby-0:2.4.5-90.el7cf

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: rubygem-bcrypt-0:3.1.12-1.el7cf

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: rubygem-ffi-0:1.9.25-1.el7cf

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: rubygem-hamlit-0:2.8.8-1.el7cf

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: rubygem-http_parser.rb-0:0.6.0-1.el7cf

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: rubygem-json-0:2.1.0-1.el7cf

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: rubygem-linux_block_device-0:0.2.1-1.el7cf

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: rubygem-memory_buffer-0:0.1.0-2.el7cf

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: rubygem-nio4r-0:2.3.1-1.el7cf

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: rubygem-nokogiri-0:1.8.2-1.el7cf

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: rubygem-ovirt-engine-sdk4-0:4.2.4-1.el7cf

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: rubygem-pg-0:0.18.4-2.el7cf

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: rubygem-redhat_access_cfme-0:2.0.3-1.el7cf

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: rubygem-redhat_access_lib-0:1.1.4-2.el7cf

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: rubygem-rugged-0:0.27.4-1.el7cf

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: rubygem-sqlite3-0:1.3.13-2.el7cf

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: rubygem-unf_ext-0:0.0.7.5-1.el7cf

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: rubygem-websocket-driver-0:0.6.5-1.el7cf

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: smem-0:1.4-1.el7cf

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: supervisor-0:3.1.4-1.el7

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: wmi-0:1.3.14-7.el7cf

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: wxGTK3-0:3.0.3-5.el7at

redhatpatch availablevia redhat_api

Product: CloudForms Management Engine 5.10Fixed in: rubygem-qpid_proton-0:0.22.0-2.el7cf

rubygemspatch availablevia ghsa

Product: nokogiriFixed in: 1.5.4

redhatvendor investigatingvia redhat_api

Product: Red Hat Enterprise Linux OpenStack Platform 6 (Juno) InstallerFixed in: ruby193-rubygem-nokogiri

redhatend of lifevia redhat_api

Product: Red Hat Subscription Asset ManagerFixed in: rubygem-nokogiri

redhatend of lifevia redhat_api

Product: OpenStack ForemanFixed in: ruby193-rubygem-nokogiri

redhatend of lifevia redhat_api

Product: Red Hat Enterprise MRG 2Fixed in: rubygem-nokogiri

redhatend of lifevia redhat_api

Product: Red Hat OpenShift Enterprise 2Fixed in: ruby193-rubygem-nokogiri

redhatend of lifevia redhat_api

Product: Red Hat OpenShift Enterprise 2Fixed in: rubygem-nokogiri

redhatend of lifevia redhat_api

Product: Red Hat OpenStack Platform 4Fixed in: ruby193-rubygem-nokogiri

redhatend of lifevia redhat_api

Product: Red Hat Satellite 6Fixed in: ruby193-rubygem-nokogiri

redhatend of lifevia redhat_api

Product: Red Hat Subscription Asset ManagerFixed in: ruby193-rubygem-nokogiri

Vendor Advisories (2)

rubygemsGHSA-6wj9-77wq-jq7phigh

Nokogiri is vulnerable to XML External Entity (XXE) attack

redhatCVE-2012-6685Moderate

rubygem-nokogiri: XML eXternal Entity (XXE) flaw

References

bugzilla.redhat.com / show_bug.cgi

Issue TrackingThird Party Advisory

github.com / sparklemotion/nokogiri/issues/693

ExploitIssue TrackingThird Party Advisory

nokogiri.org / CHANGELOG.html

Release NotesVendor Advisory