zend framework vulnerabilities and fixes

Recent CVEs affecting zend framework, with upgrade or downgrade steps. 15 tracked.

Also searched as: zendframework.

zend framework has 15 tracked vulnerabilities, 10 critical. A fixed release or vendor patch exists for 12. Most recent: 2023-04-04. Highest priority: CVE-2011-1939 (score 72/100).

• CVE-2020-29312 CRITICAL 9.8 UPGRADE An issue found in Zend Framework v.3.1.3 and before allow a remote attacker to execute arbitrary code via the
• CVE-2021-3007 CRITICAL 9.8 UPGRADE DOWNGRADE Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that
• CVE-2016-6233 CRITICAL 9.8 MITIGATE UPGRADE The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.19 might allow remote
• CVE-2016-4861 CRITICAL 9.8 MITIGATE UPGRADE The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.20 might allow remote
• CVE-2016-10034 CRITICAL 9.8 UPGRADE UPGRADE The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x
• CVE-2015-7695 CRITICAL 9.8 UPGRADE MITIGATE The PDO adapters in Zend Framework before 1.12.16 do not filer null bytes in SQL statements, which allows remo
• CVE-2015-7503 HIGH 7.5 DOWNGRADE Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remot
• CVE-2015-5723 HIGH 7.8 UPGRADE MITIGATE Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x be
• CVE-2015-1786 HIGH 8.8 DOWNGRADE Cross-site request forgery (CSRF) vulnerability in Zend/Validator/Csrf in Zend Framework 2.3.x before 2.3.6 vi
• CVE-2015-1555 CRITICAL 9.1 DOWNGRADE Zend/Session/SessionManager in Zend Framework 2.2.x before 2.2.9, 2.3.x before 2.3.4 allows remote attackers t
• CVE-2014-8089 CRITICAL 9.8 UPGRADE MITIGATE SQL injection vulnerability in Zend Framework before 1.12.9, 2.2.x before 2.2.8, and 2.3.x before 2.3.3, when
• CVE-2014-4914 CRITICAL 9.8 UPGRADE MITIGATE The Zend_Db_Select::order function in Zend Framework before 1.12.7 does not properly handle parentheses, which
• CVE-2014-4913 MEDIUM 6.1 UPGRADE MITIGATE ZF2014-03 has a potential cross site scripting vector in multiple view helpers
• CVE-2012-4451 MEDIUM 6.1 UPGRADE MITIGATE Multiple cross-site scripting (XSS) vulnerabilities in Zend Framework 2.0.x before 2.0.1 allow remote attacker
• CVE-2011-1939 CRITICAL 9.8 UPGRADE UPGRADE SQL injection vulnerability in Zend Framework 1.10.x before 1.10.9 and 1.11.x before 1.11.6 when using non-ASC

FAQ

How do I fix zend framework vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is zend framework being exploited right now?

None of the tracked zend framework CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which zend framework CVE should I patch first?

CVE-2011-1939 currently ranks highest (72/100): SQL injection vulnerability in Zend Framework 1.10.x before 1.10.9 and 1.11.x before 1.11.6 when using non-ASC.

RSS feed for zend framework · ← Back to latest CVEs