PT-2017-7207 · Zend · Zend Framework+1

Adam Mariš · Publicado 2016-05-21 · Atualizado 2022-05-17 · CVE-2015-7503

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zend Framework versions prior to 2.4.9 zend-crypt versions 2.4.x prior to 2.4.9 zend-crypt versions 2.5.x prior to 2.5.2

Description The issue allows remote attackers to recover the RSA private key.

Recommendations For Zend Framework versions prior to 2.4.9, update to version 2.4.9 or later. For zend-crypt versions 2.4.x prior to 2.4.9, update to version 2.4.9 or later. For zend-crypt versions 2.5.x prior to 2.5.2, update to version 2.5.2 or later.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-320

CWE-200

Identificadores relacionados

CVE-2015-7503

GHSA-PM9M-W23Q-5967

MGASA-2016-0196

Produtos afetados

Zend Framework

Zend-Crypt

Referências · 11

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zend-crypt/CVE-2015-7503.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/CVE-2015-7503.yaml · Exploit
• https://github.com/zendframework/zendframework · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-7503 · Nota de Segurança
• https://framework.zend.com/security/advisory/ZF2015-10 · Aviso do Fabricante
• https://osv.dev/vulnerability/MGASA-2016-0196 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-pm9m-w23q-5967 · Aviso do Fabricante
• http://framework.zend.com/security/advisory/ZF2015-10 · Nota
• https://bugs.mageia.org/show_bug.cgi?id=18259 · Nota
• https://advisories.mageia.org/MGASA-2016-0196.html · Nota de Segurança
• https://bugzilla.redhat.com/show_bug.cgi?id=1283137 · Nota