GitHub Advisoryadvisory · Packagist

GHSA-v59p-p692-v382 Zend Framework Allows SQL Injection

CRITICAL Published 2022-05-24 Modified 2023-12-07 Official page ↗
Aliases
CVE-2015-0270
Ecosystem
Packagist
Packages
zendframework/zendframework, zendframework/zend-db
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Reviewed
2023-08-01

Affected packages

• Packagist zendframework/zendframework: < 2.2.10 → fixed in 2.2.10 • Packagist zendframework/zendframework: >= 2.3.0, < 2.3.5 → fixed in 2.3.5 • Packagist zendframework/zend-db: < 2.2.10 → fixed in 2.2.10 • Packagist zendframework/zend-db: >= 2.3.0, < 2.3.5 → fixed in 2.3.5

Description

Zend Framework before 2.2.10 and 2.3.x before 2.3.5 has Potential SQL injection in PostgreSQL Zend\Db adapter.

Related

Alias · CVE (1)

  • CVE-2015-0270 Zend Framework before 2.2.10 and 2.3.x before 2.3.5 has Potential SQL injection in PostgreSQL Zend\Db adapter. vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References