CVE-2015-3154 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	6.1 MEDIUM	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 59%

Affected Products (NVD)

Vendor	Product	Version
zend	zend_framework	𝑥 < 1.12.12
zend	zend_framework	2.3.0 ≤ 𝑥 < 2.3.8
zend	zend_framework	2.4.0 ≤ 𝑥 < 2.4.1

𝑥

= Vulnerable software versions

Ubuntu Releases

Ubuntu Product

Codename

zend-framework

artful	dne
bionic	dne
cosmic	dne
disco	dne
eoan	dne
focal	dne
groovy	dne
hirsute	dne
impish	dne
jammy	dne
mantic	dne
noble	dne
precise	ignored
trusty	dne
utopic	ignored
vivid	ignored
wily	ignored
xenial	needed
yakkety	ignored
zesty	dne

zendframework

artful	ignored
bionic	not-affected
cosmic	not-affected
disco	dne
eoan	dne
focal	dne
groovy	dne
hirsute	dne
impish	dne
jammy	dne
mantic	dne
noble	dne
precise	dne
trusty	dne
wily	dne
xenial	dne
yakkety	dne
zesty	ignored

Amazon Linux Releases

Amazon Package

Release

php-ZendFramework

Amazon Linux 1

0:1.12.13-1.11.amzn1

fixed

php-ZendFramework-Auth-Adapter-Ldap

Amazon Linux 1

0:1.12.13-1.11.amzn1

fixed

php-ZendFramework-Cache-Backend-Apc

Amazon Linux 1

0:1.12.13-1.11.amzn1

fixed

php-ZendFramework-Cache-Backend-Libmemcached

Amazon Linux 1

0:1.12.13-1.11.amzn1

fixed

php-ZendFramework-Cache-Backend-Memcached

Amazon Linux 1

0:1.12.13-1.11.amzn1

fixed

php-ZendFramework-Captcha

Amazon Linux 1

0:1.12.13-1.11.amzn1

fixed

php-ZendFramework-Db-Adapter-Mysqli

Amazon Linux 1

0:1.12.13-1.11.amzn1

fixed

php-ZendFramework-Db-Adapter-Pdo

Amazon Linux 1

0:1.12.13-1.11.amzn1

fixed

php-ZendFramework-Db-Adapter-Pdo-Mssql

Amazon Linux 1

0:1.12.13-1.11.amzn1

fixed

php-ZendFramework-Db-Adapter-Pdo-Mysql

Amazon Linux 1

0:1.12.13-1.11.amzn1

fixed

php-ZendFramework-Db-Adapter-Pdo-Pgsql

Amazon Linux 1

0:1.12.13-1.11.amzn1

fixed

php-ZendFramework-Dojo

Amazon Linux 1

0:1.12.13-1.11.amzn1

fixed

php-ZendFramework-Feed

Amazon Linux 1

0:1.12.13-1.11.amzn1

fixed

php-ZendFramework-Ldap

Amazon Linux 1

0:1.12.13-1.11.amzn1

fixed

php-ZendFramework-Pdf

Amazon Linux 1

0:1.12.13-1.11.amzn1

fixed

php-ZendFramework-Search-Lucene

Amazon Linux 1

0:1.12.13-1.11.amzn1

fixed

php-ZendFramework-Serializer-Adapter-Igbinary

Amazon Linux 1

0:1.12.13-1.11.amzn1

fixed

php-ZendFramework-Services

Amazon Linux 1

0:1.12.13-1.11.amzn1

fixed

php-ZendFramework-Soap

Amazon Linux 1

0:1.12.13-1.11.amzn1

fixed

php-ZendFramework-demos

Amazon Linux 1

0:1.12.13-1.11.amzn1

fixed

php-ZendFramework-extras

Amazon Linux 1

0:1.12.13-1.11.amzn1

fixed

php-ZendFramework-full

Amazon Linux 1

0:1.12.13-1.11.amzn1

fixed

Known Exploits!

Common Weakness Enumeration

CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The software constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

References

http://framework.zend.com/security/advisory/ZF2015-04