PT-2017-5934 · Zend · Zend Framework

Cassiano Dal Pizzol · Publicado 2014-08-05 · Atualizado 2018-01-17 · CVE-2014-4914

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Zend Framework versions prior to 1.12.7

Description: The issue concerns the Zend Db Select::order function, which does not properly handle parentheses. This allows remote attackers to conduct SQL injection attacks via unspecified vectors.

Recommendations: For versions prior to 1.12.7, update to version 1.12.7 or later to resolve the issue.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2014-4914

DLA-251-1

DSA-3265-1

DSA-3265-2

MGASA-2014-0311

Produtos afetados

Zend Framework

Referências · 31

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8089 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8088 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3154 · Nota de Segurança
• https://lists.fedoraproject.org/pipermail/package-announce/2014-July/135671.html · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/DSA-3265-2 · Aviso do Fabricante
• https://osv.dev/vulnerability/DSA-3265-1 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/source-package/zendframework · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4914 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2682 · Nota de Segurança
• https://packages.debian.org/src:zendframework · Nota
• http://framework.zend.com/security/advisory/ZF2014-04 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2681 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2684 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2685 · Nota de Segurança
• https://debian.org/security/2015/dsa-3265 · Aviso do Fabricante