PT-2020-7833 · Zend · Zend-Mail+1

Filippo Tessarotto + 1 · Published 2015-05-20 · Updated 2022-05-24 · CVE-2015-3154

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Zend Framework versions prior to 1.12.12 Zend Framework 2.x versions prior to 2.3.8 Zend Framework 2.4.x versions prior to 2.4.1

Description: A CRLF injection vulnerability in ZendMail (Zend Mail) allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email.

Recommendations: For versions prior to 1.12.12, update to version 1.12.12 or later. For 2.x versions prior to 2.3.8, update to version 2.3.8 or later. For 2.4.x versions prior to 2.4.1, update to version 2.4.1 or later.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2015-3154

DLA-251-1

DSA-3265-1

DSA-3265-2

GHSA-5957-5CRX-79JX

MGASA-2015-0241

Affected Products

Zend Framework

Zend-Mail

References · 22

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/CVE-2015-3154.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zend-http/CVE-2015-3154.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/CVE-2015-3154.yaml · Exploit
• 🔥 http://framework.zend.com/security/advisory/ZF2015-04 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-3154 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-3154 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2015-0241.html · Security Note
• https://ubuntu.com/security/CVE-2015-3154 · Vendor Advisory
• https://debian.org/security/2015/dsa-3265 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2015-0241 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5957-5crx-79jx · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3265-2 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-3154 · Security Note
• https://osv.dev/vulnerability/DSA-3265-1 · Vendor Advisory
• https://github.com/zendframework/zendframework · Note