GitHub Advisoryadvisory · Packagist
GHSA-9wv8-3h8h-x2wc doctrine/doctrine-module zero-valued authentication credentials vulnerability
MEDIUM
Official page ↗
- Ecosystem
- Packagist
- Packages
- doctrine/doctrine-module
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
- Reviewed
- 2024-05-15
Affected packages
• Packagist doctrine/doctrine-module: < 0.7.2 → fixed in 0.7.2
Description
it is possible (under certain circumstances) to obtain a valid `Zend\Authentication` identity even without knowing the user's credentials by using a numerically valued credential in `DoctrineModule\Authentication\Adapter\ObjectRepository`.
References
- https://github.com/doctrine/DoctrineModule/issues/248 web
- https://github.com/doctrine/DoctrineModule/issues/249 web
- https://github.com/doctrine/DoctrineModule/commit/78018ef568c52e65a0b17e7bd5a4c90fe6673e84 web
- https://github.com/FriendsOfPHP/security-advisories/blob/master/doctrine/doctrine-module/2013-05-16.yaml web
- https://github.com/doctrine/DoctrineModule package