GitHub Advisoryadvisory · Packagist

GHSA-5957-5crx-79jx Zenario CMS vulnerable to CRLF injection

MEDIUM Published 2022-05-24 Modified 2023-12-07 Official page ↗
Aliases
CVE-2015-3154
Ecosystem
Packagist
Packages
zendframework/zend-http, zendframework/zendframework, zendframework/zendframework1
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-74
Reviewed
2023-08-01

Affected packages

• Packagist zendframework/zend-http: >= 2.0.0beta4, < 2.3.8 → fixed in 2.3.8 • Packagist zendframework/zend-http: >= 2.4.0rc1, < 2.4.1 → fixed in 2.4.1 • Packagist zendframework/zendframework: >= 2.0.0beta4, < 2.3.8 → fixed in 2.3.8 • Packagist zendframework/zendframework: >= 2.4.0rc1, < 2.4.1 → fixed in 2.4.1 • Packagist zendframework/zendframework1: < 1.12.12 → fixed in 1.12.12 • Packagist zendframework/zend-http: < 1.12.12 → fixed in 1.12.12

Description

CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email.

Related

Alias · CVE (1)

  • CVE-2015-3154 CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows… vulnerability

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References