PT-2017-7207 · Zend · Zend Framework+1

Adam Mariš · Published 2016-05-21 · Updated 2022-05-17 · CVE-2015-7503

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zend Framework versions prior to 2.4.9 zend-crypt versions 2.4.x prior to 2.4.9 zend-crypt versions 2.5.x prior to 2.5.2

Description The issue allows remote attackers to recover the RSA private key.

Recommendations For Zend Framework versions prior to 2.4.9, update to version 2.4.9 or later. For zend-crypt versions 2.4.x prior to 2.4.9, update to version 2.4.9 or later. For zend-crypt versions 2.5.x prior to 2.5.2, update to version 2.5.2 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-320

CWE-200

Related Identifiers

CVE-2015-7503

GHSA-PM9M-W23Q-5967

MGASA-2016-0196

Affected Products

Zend Framework

Zend-Crypt

References · 11

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zend-crypt/CVE-2015-7503.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/CVE-2015-7503.yaml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-7503 · Security Note
• https://framework.zend.com/security/advisory/ZF2015-10 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2016-0196 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pm9m-w23q-5967 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2016-0196.html · Security Note
• https://github.com/zendframework/zendframework · Note
• http://framework.zend.com/security/advisory/ZF2015-10 · Note
• https://bugs.mageia.org/show_bug.cgi?id=18259 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1283137 · Note