CVE-2012-6091: Zend_XmlRpc Class in Magento before 1.7.0.2 contains an information disclosure vulnerability.

Security readout for executives and security teams

CVE-2012-6091 is an information disclosure issue in Magento’s Zend_XmlRpc class before Magento 1.7.0.2. The public bundle identifies a fix in 1.7.0.2 but does not provide severity scoring, CWE mapping, or detailed disclosure scope. Treat remaining affected Magento deployments as requiring review, especially if XML-RPC functionality is reachable. Exposure is most likely in legacy Magento installations running 1.7.0.1 or another pre-1.7.0.2 version where the affected Zend_XmlRpc functionality is present. The bundle does not identify hosted services, extensions, configuration prerequisites, or downstream packages beyond Magento. Set priority based on whether any internet-facing legacy Magento instance remains. The issue is old and not KEV-listed, but Magento often supports business-critical commerce workflows, so unresolved exposure should be removed during legacy platform remediation. Mitigation focus: Upgrade affected Magento deployments to 1.7.0.2 or a later vendor-fixed release.; Inventory any remaining Magento versions before 1.7.0.2.; Review vendor guidance for deployment-specific patch or upgrade notes..

Prepared

Jun 6, 2026, 02:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.