PT-2017-5934 · Zend · Zend Framework

Cassiano Dal Pizzol · Published 2014-08-05 · Updated 2018-01-17 · CVE-2014-4914

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Zend Framework versions prior to 1.12.7

Description: The issue concerns the Zend Db Select::order function, which does not properly handle parentheses. This allows remote attackers to conduct SQL injection attacks via unspecified vectors.

Recommendations: For versions prior to 1.12.7, update to version 1.12.7 or later to resolve the issue.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2014-4914

DLA-251-1

DSA-3265-1

DSA-3265-2

MGASA-2014-0311

Affected Products

Zend Framework

References · 31

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8089 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8088 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3154 · Security Note
• https://lists.fedoraproject.org/pipermail/package-announce/2014-July/135671.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-3265-2 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3265-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/zendframework · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2682 · Security Note
• http://framework.zend.com/security/advisory/ZF2014-04 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2681 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2684 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2685 · Security Note
• https://debian.org/security/2015/dsa-3265 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0311 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-3265-1 · Vendor Advisory