PT-2017-6518 · Zend · Zend Framework

Vasyl Kaigorodov · Publicado 2017-06-08 · Atualizado 2022-05-17 · CVE-2015-1786

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zend Framework versions 2.3.x through 2.3.5

Description A cross-site request forgery (CSRF) issue exists due to null or malformed token identifiers in the Zend/Validator/Csrf component.

Recommendations For versions 2.3.x through 2.3.5, update to version 2.3.6 or later to resolve the issue.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2015-1786

GHSA-GWWQ-54QP-9PGP

Produtos afetados

Zend Framework

Referências · 10

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/CVE-2015-1786.yaml · Exploit
• https://github.com/zendframework/zendframework/commit/213d2c490f55331ba4e5e3884bd81d13d1eb0aee · Nota
• https://github.com/zendframework/zf-web/blob/f97fe5c3cf6c51df7502237c6342511802c8df22/module/Security/view/security/advisory/ZF2015-03.phtml · Nota
• https://github.com/zendframework/zf3-web/blob/5852ab5bfd47285e6b46f9e7b13250629b3e372e/data/advisories/ZF2015-03.md · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=1207781 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1786 · Nota
• https://framework.zend.com/changelog/2.3.6 · Aviso do Fabricante
• https://framework.zend.com/security/advisory/ZF2015-03 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-1786 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-gwwq-54qp-9pgp · Aviso do Fabricante