GHSA-pw5c-xqf2-6xc2 CVE-2015-5723
Doctrine Security Misconfiguration Vulnerability
High
Packagist
- Severity
- 7.8 / 10
- High · CVSS 3.0
- Exploit chance (EPSS)
- 0.38%
- Chance of exploitation in the next 30 days. Higher than 32.15% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
- Available
- 11 packages have a fixed version
Description
Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before 1.0.2, and MongoDB ODM Bundle before 3.0.1 use world-writable permissions for cache directories, which allows local users to execute arbitrary PHP code with additional privileges by leveraging an application with the umask set to 0 and that executes cache entries as code.
Affected versions
Packagist
| Package | Vulnerable | Fixed in |
|---|---|---|
| aws/aws-sdk-php | >= 3.0.0, < 3.2.1 |
3.2.1 |
| doctrine/annotations | < 1.2.7 |
1.2.7 |
| doctrine/cache | >= 1.4.0, < 1.4.2 |
1.4.2 |
| doctrine/cache | >= 1.0.0, < 1.3.2 |
1.3.2 |
| doctrine/common | < 2.4.3 |
2.4.3 |
| doctrine/common | >= 2.5.0-stable, < 2.5.1 |
2.5.1 |
| doctrine/mongodb-odm | < 1.0.2 |
1.0.2 |
| doctrine/mongodb-odm-bundle | < 3.0.1 |
3.0.1 |
| doctrine/orm | >= 2.5.0, < 2.5.1 |
2.5.1 |
| zendframework/zend-cache | >= 2.5.0, < 2.5.3 |
2.5.3 |
| zendframework/zend-cache | >= 2.4.0, < 2.4.8 |
2.4.8 |
| zendframework/zendframework | >= 2.4.0, < 2.4.8 |
2.4.8 |
| zendframework/zendframework1 | >= 1.12.0, < 1.12.16 |
1.12.16 |
| zfcampus/zf-apigility-doctrine | >= 1.0.0, < 1.0.3 |
1.0.3 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
aws/aws-sdk-php Packagist → 3.2.1
- composer
composer require aws/aws-sdk-php:^3.2.1
doctrine/annotations Packagist → 1.2.7
- composer
composer require doctrine/annotations:^1.2.7
doctrine/cache Packagist → 1.4.2
- composer
composer require doctrine/cache:^1.4.2
doctrine/common Packagist → 2.4.3
- composer
composer require doctrine/common:^2.4.3
doctrine/mongodb-odm Packagist → 1.0.2
- composer
composer require doctrine/mongodb-odm:^1.0.2
doctrine/mongodb-odm-bundle Packagist → 3.0.1
- composer
composer require doctrine/mongodb-odm-bundle:^3.0.1
doctrine/orm Packagist → 2.5.1
- composer
composer require doctrine/orm:^2.5.1
zendframework/zend-cache Packagist → 2.5.3
- composer
composer require zendframework/zend-cache:^2.5.3
zendframework/zendframework Packagist → 2.4.8
- composer
composer require zendframework/zendframework:^2.4.8
zendframework/zendframework1 Packagist → 1.12.16
- composer
composer require zendframework/zendframework1:^1.12.16
zfcampus/zf-apigility-doctrine Packagist → 1.0.3
- composer
composer require zfcampus/zf-apigility-doctrine:^1.0.3
Severity breakdown
CVSS 3.0 7.8
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
References
Advisories
Other links
- framework.zend.com/security/advisory/ZF2015-07
- github.com/FriendsOfPHP/security-advisories/blob/master/aws/aws-sdk-php/CVE-201…
- github.com/FriendsOfPHP/security-advisories/blob/master/doctrine/cache/CVE-2015…
- github.com/FriendsOfPHP/security-advisories/blob/master/doctrine/orm/CVE-2015-5…
- github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zend-cach…
- github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframe…
- github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframe…
- github.com/FriendsOfPHP/security-advisories/blob/master/zfcampus/zf-apigility-d…
- github.com/aws/aws-sdk-php/releases/tag/3.2.1
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2IU…
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HPS…
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2IUUC…
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HPS7A…
- doctrine-project.org/2015/08/31/security_misconfiguration_vulnerability_in_various_doctri…
- framework.zend.com/security/advisory/ZF2015-07
- debian.org/security/2015/dsa-3369
- doctrine-project.org/2015/08/31/security_misconfiguration_vulnerability_in_various_doctri…
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-6fqw-j3vm-7f66 Zendframework1 Potential SQL injection in ORDER and GROUP functions | Critical | Also affects zendframework/zendframework1 |
| GHSA-848f-mph5-9pm9 Zendframework Potential Information Disclosure and Insufficient Entropy vulnerability | High | Also affects zendframework/zendframework1 |
| GHSA-8xhv-gqm4-3w99 ZendFramework1 Potential Insufficient Entropy Vulnerability | High | Also affects zendframework/zendframework1 |
| GHSA-v42g-7q2x-cw32 Zendframework1 potential SQL injection vector using null byte for PDO (MsSql, SQLite) | Critical | Also affects zendframework/zendframework1 |
| GHSA-2x36-qhx3-7m5f ZendFramework1 Potential SQL injection in the ORDER implementation of Zend_Db_Select | Critical | Also affects zendframework/zendframework1 |
| GHSA-9v78-h226-2rmq Zendframework potential security issue in login mechanism | High | Also affects zendframework/zendframework1 |
| GHSA-4vf6-mq7w-3hp6 Zend_Filter_StripTags vulnerable to Cross-site Scripting when comments allowed | Medium | Also affects zendframework/zendframework1 |
| GHSA-4v57-pwvf-x35j Zendframework potential Cross-site Scripting vector in `Zend_Service_ReCaptcha_MailHide` | Medium | Also affects zendframework/zendframework1 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor