PT-2017-6518 · Zend · Zend Framework

Vasyl Kaigorodov · Published 2017-06-08 · Updated 2022-05-17 · CVE-2015-1786

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zend Framework versions 2.3.x through 2.3.5

Description A cross-site request forgery (CSRF) issue exists due to null or malformed token identifiers in the Zend/Validator/Csrf component.

Recommendations For versions 2.3.x through 2.3.5, update to version 2.3.6 or later to resolve the issue.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2015-1786

GHSA-GWWQ-54QP-9PGP

Affected Products

Zend Framework

References · 10

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/CVE-2015-1786.yaml · Exploit
• https://framework.zend.com/changelog/2.3.6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-1786 · Security Note
• https://osv.dev/vulnerability/GHSA-gwwq-54qp-9pgp · Vendor Advisory
• https://github.com/zendframework/zendframework/commit/213d2c490f55331ba4e5e3884bd81d13d1eb0aee · Note
• https://github.com/zendframework/zf-web/blob/f97fe5c3cf6c51df7502237c6342511802c8df22/module/Security/view/security/advisory/ZF2015-03.phtml · Note
• https://github.com/zendframework/zf3-web/blob/5852ab5bfd47285e6b46f9e7b13250629b3e372e/data/advisories/ZF2015-03.md · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1207781 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1786 · Note
• https://framework.zend.com/security/advisory/ZF2015-03 · Note