Vulnerabilites related to zend - zendopenid
Vulnerability from fkie_nvd
Published
2014-11-16 00:59
Modified
2025-04-12 10:46
Severity ?
Summary
Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0 allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, and possibly cause a denial of service (CPU and memory consumption) via an XML External Entity (XXE) attack. NOTE: this issue exists because of an incomplete fix for CVE-2012-5657.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| zend | zendrest | * | |
| zend | zend_framework | * | |
| zend | zend_framework | * | |
| zend | zend_framework | * | |
| zend | zendservice_slideshare | * | |
| zend | zendservice_api | * | |
| zend | zendservice_audioscrobbler | * | |
| zend | zendservice_amazon | * | |
| zend | zendservice_technorati | * | |
| zend | zendservice_windowsazure | * | |
| zend | zendopenid | * | |
| zend | zendservice_nirvanix | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zend:zendrest:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8355D554-59F8-40DE-BEED-9608E710689F",
"versionEndIncluding": "2.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zend:zend_framework:*:*:*:*:*:*:*:*",
"matchCriteriaId": "836B23B2-F868-4068-8CAE-F9E0C9844D35",
"versionEndExcluding": "1.12.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CADA4077-F8CC-44EB-854A-8397EEF4D99D",
"versionEndExcluding": "2.1.6",
"versionStartIncluding": "2.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1211BC37-763D-4B18-87D8-6727CC049F81",
"versionEndExcluding": "2.2.6",
"versionStartIncluding": "2.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zend:zendservice_slideshare:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7EA03FE2-F2AF-4AAC-8699-B83428A177B9",
"versionEndIncluding": "2.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zend:zendservice_api:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C2BF3B28-536C-478F-8837-91AEAF4E182F",
"versionEndIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zend:zendservice_audioscrobbler:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AE7B01AC-43F4-46C7-ADFD-25EB628A3060",
"versionEndIncluding": "2.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zend:zendservice_amazon:*:*:*:*:*:*:*:*",
"matchCriteriaId": "48545222-B223-4056-8AE4-0462089A8FDD",
"versionEndIncluding": "2.0.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zend:zendservice_technorati:*:*:*:*:*:*:*:*",
"matchCriteriaId": "01842993-10EC-49E4-BDC8-BB2379B0A938",
"versionEndIncluding": "2.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zend:zendservice_windowsazure:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4C20DCB6-DB3C-4D05-A80C-83E6A9E1BFDF",
"versionEndIncluding": "2.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zend:zendopenid:*:*:*:*:*:*:*:*",
"matchCriteriaId": "255171B6-0A4C-4757-ADDA-28916398499C",
"versionEndIncluding": "2.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zend:zendservice_nirvanix:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AD90BDD0-0155-4D4C-AA05-FF87C6ABC47F",
"versionEndIncluding": "2.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0 allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, and possibly cause a denial of service (CPU and memory consumption) via an XML External Entity (XXE) attack. NOTE: this issue exists because of an incomplete fix for CVE-2012-5657."
},
{
"lang": "es",
"value": "Zend Framework 1 (ZF1) anterior a 1.12.4, Zend Framework 2 anterior a 2.1.6 y 2.2.x anterior a 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, y ZendService_WindowsAzure anterior a 2.0.2, ZendService_Amazon anterior a 2.0.2, ZendService_Amazon anterior a 2.0.3, y ZendService_Api anterior a 1.0.0 permite a atacantes remotos leer ficheros arbitrarios, enviar peticiones HTTP al servidor de una intranet, y posiblemente causar una denegaci\u00f3n de servicio (Consumo de CPU y memoria) a trav\u00e9s de un ataque XXE por XML. NOTA: este fallo existe porque no se corrigi\u00f3 CVE-2012-5657."
}
],
"id": "CVE-2014-2681",
"lastModified": "2025-04-12T10:46:40.837",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2014-11-16T00:59:00.123",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://advisories.mageia.org/MGASA-2014-0151.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://framework.zend.com/security/advisory/ZF2014-01"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://seclists.org/oss-sec/2014/q2/0"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://www.debian.org/security/2015/dsa-3265"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:072"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/66358"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://advisories.mageia.org/MGASA-2014-0151.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://framework.zend.com/security/advisory/ZF2014-01"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://seclists.org/oss-sec/2014/q2/0"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://www.debian.org/security/2015/dsa-3265"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:072"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/66358"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-19"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-11-16 00:59
Modified
2025-04-12 10:46
Severity ?
Summary
Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0, when PHP-FPM is used, does not properly share the libxml_disable_entity_loader setting between threads, which might allow remote attackers to conduct XML External Entity (XXE) attacks via an XML external entity declaration in conjunction with an entity reference. NOTE: this issue exists because of an incomplete fix for CVE-2012-5657.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| zend | zendrest | * | |
| zend | zend_framework | * | |
| zend | zend_framework | * | |
| zend | zend_framework | * | |
| zend | zendservice_slideshare | * | |
| zend | zendservice_api | * | |
| zend | zendservice_audioscrobbler | * | |
| zend | zendservice_amazon | * | |
| zend | zendservice_technorati | * | |
| zend | zendservice_windowsazure | * | |
| zend | zendopenid | * | |
| zend | zendservice_nirvanix | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zend:zendrest:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8355D554-59F8-40DE-BEED-9608E710689F",
"versionEndIncluding": "2.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zend:zend_framework:*:*:*:*:*:*:*:*",
"matchCriteriaId": "836B23B2-F868-4068-8CAE-F9E0C9844D35",
"versionEndExcluding": "1.12.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CADA4077-F8CC-44EB-854A-8397EEF4D99D",
"versionEndExcluding": "2.1.6",
"versionStartIncluding": "2.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1211BC37-763D-4B18-87D8-6727CC049F81",
"versionEndExcluding": "2.2.6",
"versionStartIncluding": "2.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zend:zendservice_slideshare:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7EA03FE2-F2AF-4AAC-8699-B83428A177B9",
"versionEndIncluding": "2.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zend:zendservice_api:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C2BF3B28-536C-478F-8837-91AEAF4E182F",
"versionEndIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zend:zendservice_audioscrobbler:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AE7B01AC-43F4-46C7-ADFD-25EB628A3060",
"versionEndIncluding": "2.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zend:zendservice_amazon:*:*:*:*:*:*:*:*",
"matchCriteriaId": "48545222-B223-4056-8AE4-0462089A8FDD",
"versionEndIncluding": "2.0.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zend:zendservice_technorati:*:*:*:*:*:*:*:*",
"matchCriteriaId": "01842993-10EC-49E4-BDC8-BB2379B0A938",
"versionEndIncluding": "2.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zend:zendservice_windowsazure:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4C20DCB6-DB3C-4D05-A80C-83E6A9E1BFDF",
"versionEndIncluding": "2.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zend:zendopenid:*:*:*:*:*:*:*:*",
"matchCriteriaId": "255171B6-0A4C-4757-ADDA-28916398499C",
"versionEndIncluding": "2.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zend:zendservice_nirvanix:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AD90BDD0-0155-4D4C-AA05-FF87C6ABC47F",
"versionEndIncluding": "2.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0, when PHP-FPM is used, does not properly share the libxml_disable_entity_loader setting between threads, which might allow remote attackers to conduct XML External Entity (XXE) attacks via an XML external entity declaration in conjunction with an entity reference. NOTE: this issue exists because of an incomplete fix for CVE-2012-5657."
},
{
"lang": "es",
"value": "Zend Framework 1 (ZF1) anterior a 1.12.4, Zend Framework 2 anterior a 2.1.6 y 2.2.x anterior a 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, y ZendService_WindowsAzure anterior a 2.0.2, ZendService_Amazon before 2.0.3, y ZendService_Api anterior a 1.0.0, cuando usamos PHP-FPM, no comparte correctamente la configuraci\u00f3n entre hilos en libxml_disable_entity_loader, lo que podr\u00eda permitir a atacantes remotos realizar ataques XXE a trav\u00e9s de una declaraci\u00f3n de entidad externa de XML junto con una referencia de entidad. NOTA: este fallo existe porque no se soluci\u00f3n la CVE-2012-5657."
}
],
"id": "CVE-2014-2682",
"lastModified": "2025-04-12T10:46:40.837",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2014-11-16T00:59:02.827",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://advisories.mageia.org/MGASA-2014-0151.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://framework.zend.com/security/advisory/ZF2014-01"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://seclists.org/oss-sec/2014/q2/0"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://www.debian.org/security/2015/dsa-3265"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:072"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/66358"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://advisories.mageia.org/MGASA-2014-0151.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://framework.zend.com/security/advisory/ZF2014-01"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://seclists.org/oss-sec/2014/q2/0"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://www.debian.org/security/2015/dsa-3265"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:072"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/66358"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-19"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-11-16 00:59
Modified
2025-04-12 10:46
Severity ?
Summary
The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Zend Framework 1 before 1.12.4 does not verify that the openid_op_endpoint value identifies the same Identity Provider as the provider used in the association handle, which allows remote attackers to bypass authentication and spoof arbitrary OpenID identities by using a malicious OpenID Provider that generates OpenID tokens with arbitrary identifier and claimed_id values.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| zend | zendopenid | * | |
| zend | zend_framework | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zend:zendopenid:*:*:*:*:*:*:*:*",
"matchCriteriaId": "255171B6-0A4C-4757-ADDA-28916398499C",
"versionEndIncluding": "2.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zend:zend_framework:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6EA449F4-8463-4C40-877F-572A61445339",
"versionEndIncluding": "1.12.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Zend Framework 1 before 1.12.4 does not verify that the openid_op_endpoint value identifies the same Identity Provider as the provider used in the association handle, which allows remote attackers to bypass authentication and spoof arbitrary OpenID identities by using a malicious OpenID Provider that generates OpenID tokens with arbitrary identifier and claimed_id values."
},
{
"lang": "es",
"value": "La clase GenericConsumer en el componente Consumer en ZendOpenId anterior a 2.0.2 y la clase Zend_OpenId_Consumer en Zend Framework 1 anterior a 1.12.4 no verifican correctamente que el valor de openid_op_endpoint identifique el mismo proveedor de identidad que el proveedor manejado en la asociaci\u00f3n, lo que permite a atacantes remotos evadir la autenticaci\u00f3n y falsificar identidades OpenID de forma arbitraria usando un proveedor de OpenID malicioso que genera tokens OpenID con identificadores y valores claimed_id arbitrarios."
}
],
"id": "CVE-2014-2684",
"lastModified": "2025-04-12T10:46:40.837",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2014-11-16T00:59:04.983",
"references": [
{
"source": "cve@mitre.org",
"url": "http://advisories.mageia.org/MGASA-2014-0151.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://framework.zend.com/security/advisory/ZF2014-02"
},
{
"source": "cve@mitre.org",
"url": "http://seclists.org/oss-sec/2014/q2/0"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2015/dsa-3265"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:072"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/66358"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://advisories.mageia.org/MGASA-2014-0151.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://framework.zend.com/security/advisory/ZF2014-02"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://seclists.org/oss-sec/2014/q2/0"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2015/dsa-3265"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:072"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/66358"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-09-04 17:55
Modified
2025-04-12 10:46
Severity ?
Summary
The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Zend Framework 1 before 1.12.4 violate the OpenID 2.0 protocol by ensuring only that at least one field is signed, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zend:zend_framework:*:*:*:*:*:*:*:*",
"matchCriteriaId": "269217EF-D4A3-4789-BC72-05F2CDFDDF68",
"versionEndIncluding": "1.12.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "4C42B4F3-D79C-42DE-B86C-9E7612E71661",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.0.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "536CC39B-D305-492F-892C-6431BD7BA95F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "17673E8C-CB65-447E-8A6B-1083E6E77B42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.0.0:rc2a:*:*:*:*:*:*",
"matchCriteriaId": "CA85105D-B9FB-4147-87B7-4F4DD0324AE7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.0.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "99C549AF-2C59-4D8E-B651-EA630C3B2975",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "50EF804C-102C-47F5-A85A-63EAA7EF9BAB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7B648466-36AD-4EC0-BDE1-C976F697D58F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5C9DCE27-D2D1-4329-88F5-911DA763469C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "1417EB1F-5342-443B-AC81-3256FCCE1BFB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "ECA9145E-8B8C-4822-A1FC-A891DF92FD0C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.5.0:pl:*:*:*:*:*:*",
"matchCriteriaId": "BE686B51-76FB-442F-94BE-60E95CFF67AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.5.0:pr:*:*:*:*:*:*",
"matchCriteriaId": "2F9BD7D0-C975-4E7E-BCD1-C7FB52B1D5E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.5.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "BE350CD6-54CA-4BDF-9327-60F872098D68",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.5.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "E3603D2F-91FE-4B12-A5BC-2F63E1612A39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.5.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "04524F0F-6C21-4670-9B2C-A3B06C151799",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "01BD97A6-336A-4B8A-AFC5-C9EA1DDCCC8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "3B636257-9941-4997-9525-F8C5A920AB8A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "118C20B5-FC8D-4EBF-A7D7-975A568A31BE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7CEB67E5-D7D9-443A-9176-3104A9C068AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.6.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "20C61B54-2D08-45FD-A10A-34AD50EC3BED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.6.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "1FD68242-67DB-4C1D-8265-7839976DBCEC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.6.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "9C32036E-14BC-48AE-92A4-9DDCC96EC557",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F965C4F5-5F12-42CF-B120-758205E0E050",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "531B7A51-2B4C-4A50-A8C8-D81040FF6E31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "16D75279-B5A8-4C82-B2C0-C58DEF56A086",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.7.0:pl1:*:*:*:*:*:*",
"matchCriteriaId": "EE99D584-E652-4B9F-BD2E-45A167B1524C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.7.0:pr:*:*:*:*:*:*",
"matchCriteriaId": "0EE1CCE3-4AD0-4ABD-B4C9-5390F9CDB37F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "57D97342-CF37-486E-A3C9-FBA000F5A041",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "819E0C25-1413-4532-9427-24520E23C07B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.7.3:*:*:*:*:*:*:*",
"matchCriteriaId": "F9A96DF1-81D9-4BD3-9E62-CEECE377406D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.7.3:pl1:*:*:*:*:*:*",
"matchCriteriaId": "744FEDE8-5825-4C5C-887D-9ADCC9183AA2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.7.4:*:*:*:*:*:*:*",
"matchCriteriaId": "DF957F4D-FDFD-419B-AD2B-02E572A3BA9F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.7.5:*:*:*:*:*:*:*",
"matchCriteriaId": "000BAA0C-6546-4DEC-8B85-146508C19F5A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.7.6:*:*:*:*:*:*:*",
"matchCriteriaId": "429128C9-689E-49EA-BD8C-138FC337AB08",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.7.7:*:*:*:*:*:*:*",
"matchCriteriaId": "2096048C-7E4A-415E-AEBF-9AB7E8BCE894",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.7.8:*:*:*:*:*:*:*",
"matchCriteriaId": "9B72E45D-E298-45BD-9EE5-127D3EFEC17C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.7.9:*:*:*:*:*:*:*",
"matchCriteriaId": "07D06D35-CE63-456D-A970-5AE663175E8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "11459424-1BA2-44D0-B831-92BE6E2664E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.8.0:a1:*:*:*:*:*:*",
"matchCriteriaId": "FACC0F56-C6CB-4BC7-946E-8077B2C90B2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.8.0:b1:*:*:*:*:*:*",
"matchCriteriaId": "BB4F6AA5-8320-4451-9C8C-02D68FE4CA3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A847F7F6-18EF-44FB-9153-BD7D3223D6ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.8.2:*:*:*:*:*:*:*",
"matchCriteriaId": "EBE53880-D68C-49CB-BFE7-D1806AAD5C6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.8.3:*:*:*:*:*:*:*",
"matchCriteriaId": "45B7421E-E0C4-4594-AE81-4F3811CAAB33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.8.4:*:*:*:*:*:*:*",
"matchCriteriaId": "1EABF4FA-D4A6-4C82-BF9C-A828B906F499",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.8.4:pl1:*:*:*:*:*:*",
"matchCriteriaId": "1EA1EBE6-0E18-44FA-BE72-D6512E7409B8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.8.5:*:*:*:*:*:*:*",
"matchCriteriaId": "9F10191E-9EF7-47B8-9CDC-FCFE47AEFE50",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "6C3E24C3-21CC-4ED2-8669-5D94BD5D99AA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.9.0:a1:*:*:*:*:*:*",
"matchCriteriaId": "075019DE-CC38-4DFF-B869-5884A7AC9000",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.9.0:b1:*:*:*:*:*:*",
"matchCriteriaId": "81CC10E4-37A8-4BAD-AC6D-EAD3A7E70CD8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.9.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "8B3E9C9A-E12F-43EC-9134-4EFF2BA6B4D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "75B01DA0-E43B-456F-98CB-B806E3A54E94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DD3BA6AE-8D0D-48C4-82C2-90164113232A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.9.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4C405425-36E0-458C-9EB8-760703DF39DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.9.3:pl1:*:*:*:*:*:*",
"matchCriteriaId": "1E3911A0-F189-488A-9246-BA8B1CF9B8CB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.9.4:*:*:*:*:*:*:*",
"matchCriteriaId": "CAC94846-2345-4A62-8E57-AC7EAFCD05D7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.9.5:*:*:*:*:*:*:*",
"matchCriteriaId": "8074B0AD-C349-4BAC-9076-DD08893F5574",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.9.6:*:*:*:*:*:*:*",
"matchCriteriaId": "18F43C9F-1EE9-4B77-AD35-EB1286BED2EA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.9.7:*:*:*:*:*:*:*",
"matchCriteriaId": "557E4E4E-0022-4EEA-A08D-BFE2392147EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.9.8:*:*:*:*:*:*:*",
"matchCriteriaId": "7AC4C9BC-B0FC-4050-B998-5DB523C26EE4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C844B367-8CE3-4347-B822-FA74D29E87C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.10.0:alpha1:*:*:*:*:*:*",
"matchCriteriaId": "0AAF2D17-6E72-4E27-B94B-397DB9C3A682",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.10.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "CF93FB2E-0F51-4EE0-9A29-91B2A2311FF7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.10.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "528D7214-C4EE-40D9-83CF-F9B81382F257",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "78EAC4C3-D9D3-4F3C-A56E-C434F15860CC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6322EB6C-3CAD-4E61-AC47-FDB416F9BAEE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5A341606-0AD5-442B-BEF3-D8246402CE00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6F033605-4770-453C-9C8D-48AB36B93F23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "7CF3E847-EF03-4B57-B54F-01E2D4DA2261",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "A5E7A156-6F31-48D6-B1A7-991CDC120602",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "6AC72907-188E-4B2B-AA08-482A98227961",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "AB1E9C46-CF7B-4142-A178-C21EB3E4C844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "0227AEB0-4C45-4744-8501-B20F7B4254D3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "4A033B19-5C9B-4948-88C6-9B8E69135112",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.11.0:b1:*:*:*:*:*:*",
"matchCriteriaId": "D5B221F8-CF2D-4994-87D9-57375D0942DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.11.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "E8BCCB2A-7873-4027-AECE-024EF7A71E60",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.11.1:*:*:*:*:*:*:*",
"matchCriteriaId": "81773611-D93F-4A8A-AE36-BEE60385F39B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.11.2:*:*:*:*:*:*:*",
"matchCriteriaId": "2AAF5871-E892-4EDE-8845-E3633E10F733",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.11.3:*:*:*:*:*:*:*",
"matchCriteriaId": "99D5C2A0-11C8-458A-910F-58E7F39243C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.11.4:*:*:*:*:*:*:*",
"matchCriteriaId": "DE49C5F9-1C3D-44FD-831D-663013EDFA30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.11.5:*:*:*:*:*:*:*",
"matchCriteriaId": "B338FCC6-506F-468D-9551-B7FA22D31BD7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.11.6:*:*:*:*:*:*:*",
"matchCriteriaId": "687ABF79-8F2F-4E5F-BF2A-42AD4F60C178",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.11.7:*:*:*:*:*:*:*",
"matchCriteriaId": "82E96CB5-E6F8-4163-8A95-B72C243FF133",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.11.8:*:*:*:*:*:*:*",
"matchCriteriaId": "5F486B0E-45D9-4B15-B4B7-1C35C3B9A8C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.11.9:*:*:*:*:*:*:*",
"matchCriteriaId": "A751B994-80CF-475C-AFCC-C3645A4B2BF9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.11.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F25F13A3-867D-4D79-8B7B-9771D3DB0540",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.11.11:*:*:*:*:*:*:*",
"matchCriteriaId": "64C08E10-14D4-4ACE-9064-8322A09773C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.11.12:*:*:*:*:*:*:*",
"matchCriteriaId": "FDA4B247-94D3-400C-A575-3DBA755C24E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.11.13:*:*:*:*:*:*:*",
"matchCriteriaId": "2D934F3F-997E-44B8-A4D2-CC07FEEB7271",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.12.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1DBCDD61-759D-4623-B7ED-88E78BDE7397",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.12.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "A78C7EE7-7C12-45D2-913E-DC4902886C11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.12.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "97F3ED10-8D1F-4D01-A79B-95AAF864B0BA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.12.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "1E65648D-78FF-47D8-9F9E-66E9A8C121AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.12.0:rc4:*:*:*:*:*:*",
"matchCriteriaId": "DA6467DF-3983-4BB9-ACC7-C6AFE753E319",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.12.1:*:*:*:*:*:*:*",
"matchCriteriaId": "93186E8D-5681-4350-A6B1-C020B3C47560",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:1.12.2:*:*:*:*:*:*:*",
"matchCriteriaId": "3A65D2D2-766B-4C47-B6B8-352184D4D15A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zend:zendopenid:*:*:*:*:*:*:*:*",
"matchCriteriaId": "255171B6-0A4C-4757-ADDA-28916398499C",
"versionEndIncluding": "2.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Zend Framework 1 before 1.12.4 violate the OpenID 2.0 protocol by ensuring only that at least one field is signed, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider."
},
{
"lang": "es",
"value": "La clase GenericConsumer en el componente Consumer en ZendOpenId anterior a 2.0.2 y la clase Zend_OpenId_Consumer en Zend Framework 1 anterior a 1.12.4 violan el protocolo OpenID 2.0 al asegurar solamente que al menos un campo est\u00e9 firmado, lo que permite a atacantes remotos evadir la autenticaci\u00f3n mediante el aprovechamiento de una aserci\u00f3n de un proveedor OpenID."
}
],
"id": "CVE-2014-2685",
"lastModified": "2025-04-12T10:46:40.837",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2014-09-04T17:55:04.747",
"references": [
{
"source": "cve@mitre.org",
"url": "http://advisories.mageia.org/MGASA-2014-0151.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://framework.zend.com/security/advisory/ZF2014-02"
},
{
"source": "cve@mitre.org",
"url": "http://seclists.org/oss-sec/2014/q2/0"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2015/dsa-3265"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:072"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/66358"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://advisories.mageia.org/MGASA-2014-0151.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://framework.zend.com/security/advisory/ZF2014-02"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://seclists.org/oss-sec/2014/q2/0"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2015/dsa-3265"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:072"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/66358"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-287"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-11-16 00:59
Modified
2025-04-12 10:46
Severity ?
Summary
Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0 allow remote attackers to cause a denial of service (CPU consumption) via (1) recursive or (2) circular references in an XML entity definition in an XML DOCTYPE declaration, aka an XML Entity Expansion (XEE) attack. NOTE: this issue exists because of an incomplete fix for CVE-2012-6532.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| zend | zendrest | * | |
| zend | zend_framework | * | |
| zend | zend_framework | * | |
| zend | zend_framework | * | |
| zend | zendservice_slideshare | * | |
| zend | zendservice_api | * | |
| zend | zendservice_audioscrobbler | * | |
| zend | zendservice_amazon | * | |
| zend | zendservice_technorati | * | |
| zend | zendservice_windowsazure | * | |
| zend | zendopenid | * | |
| zend | zendservice_nirvanix | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zend:zendrest:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8355D554-59F8-40DE-BEED-9608E710689F",
"versionEndIncluding": "2.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zend:zend_framework:*:*:*:*:*:*:*:*",
"matchCriteriaId": "836B23B2-F868-4068-8CAE-F9E0C9844D35",
"versionEndExcluding": "1.12.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CADA4077-F8CC-44EB-854A-8397EEF4D99D",
"versionEndExcluding": "2.1.6",
"versionStartIncluding": "2.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zend:zend_framework:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1211BC37-763D-4B18-87D8-6727CC049F81",
"versionEndExcluding": "2.2.6",
"versionStartIncluding": "2.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zend:zendservice_slideshare:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7EA03FE2-F2AF-4AAC-8699-B83428A177B9",
"versionEndIncluding": "2.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zend:zendservice_api:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C2BF3B28-536C-478F-8837-91AEAF4E182F",
"versionEndIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zend:zendservice_audioscrobbler:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AE7B01AC-43F4-46C7-ADFD-25EB628A3060",
"versionEndIncluding": "2.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zend:zendservice_amazon:*:*:*:*:*:*:*:*",
"matchCriteriaId": "48545222-B223-4056-8AE4-0462089A8FDD",
"versionEndIncluding": "2.0.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zend:zendservice_technorati:*:*:*:*:*:*:*:*",
"matchCriteriaId": "01842993-10EC-49E4-BDC8-BB2379B0A938",
"versionEndIncluding": "2.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zend:zendservice_windowsazure:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4C20DCB6-DB3C-4D05-A80C-83E6A9E1BFDF",
"versionEndIncluding": "2.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zend:zendopenid:*:*:*:*:*:*:*:*",
"matchCriteriaId": "255171B6-0A4C-4757-ADDA-28916398499C",
"versionEndIncluding": "2.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zend:zendservice_nirvanix:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AD90BDD0-0155-4D4C-AA05-FF87C6ABC47F",
"versionEndIncluding": "2.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0 allow remote attackers to cause a denial of service (CPU consumption) via (1) recursive or (2) circular references in an XML entity definition in an XML DOCTYPE declaration, aka an XML Entity Expansion (XEE) attack. NOTE: this issue exists because of an incomplete fix for CVE-2012-6532."
},
{
"lang": "es",
"value": "ZendFramework 1(ZF1) anterior a 1.12.4, Zend Framework anterior a 2.1.6 y 2.2.x anterior a 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, y ZendService_WindowsAzure anterior a 2.0.2, ZendService_Amazon anterior a 2.0.3, y ZendService_Api anterior a 1.0.0 permite a atacantes remotos causar una denegaci\u00f3n de servicio (Consumir la CPU) a trav\u00e9s de referencias recursivas o circulares en una definici\u00f3n de una entidad en XML en una declaraci\u00f3n DOCTYPE XML tambi\u00e9n conocido como ataque XEE. Nota: este fallo existe porque no se termino de solucionar la CVE-2012-6532"
}
],
"id": "CVE-2014-2683",
"lastModified": "2025-04-12T10:46:40.837",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2014-11-16T00:59:03.920",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://advisories.mageia.org/MGASA-2014-0151.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://framework.zend.com/security/advisory/ZF2014-01"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://seclists.org/oss-sec/2014/q2/0"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://www.debian.org/security/2015/dsa-3265"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:072"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/66358"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://advisories.mageia.org/MGASA-2014-0151.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://framework.zend.com/security/advisory/ZF2014-01"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://seclists.org/oss-sec/2014/q2/0"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://www.debian.org/security/2015/dsa-3265"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:072"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/66358"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-17"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
CVE-2014-2683 (GCVE-0-2014-2683)
Vulnerability from cvelistv5
Published
2014-11-16 00:00
Modified
2024-08-06 10:21
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0 allow remote attackers to cause a denial of service (CPU consumption) via (1) recursive or (2) circular references in an XML entity definition in an XML DOCTYPE declaration, aka an XML Entity Expansion (XEE) attack. NOTE: this issue exists because of an incomplete fix for CVE-2012-6532.
References
| ▼ | URL | Tags |
|---|---|---|
| http://seclists.org/oss-sec/2014/q2/0 | mailing-list, x_refsource_MLIST | |
| http://www.mandriva.com/security/advisories?name=MDVSA-2014:072 | vendor-advisory, x_refsource_MANDRIVA | |
| http://advisories.mageia.org/MGASA-2014-0151.html | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/66358 | vdb-entry, x_refsource_BID | |
| http://www.debian.org/security/2015/dsa-3265 | vendor-advisory, x_refsource_DEBIAN | |
| http://framework.zend.com/security/advisory/ZF2014-01 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T10:21:36.135Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[oss-security] 20140331 CVE requests: Zend Framework issues fixed in ZF2014-01 and ZF2014-02",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://seclists.org/oss-sec/2014/q2/0"
},
{
"name": "MDVSA-2014:072",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:072"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://advisories.mageia.org/MGASA-2014-0151.html"
},
{
"name": "66358",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/66358"
},
{
"name": "DSA-3265",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2015/dsa-3265"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://framework.zend.com/security/advisory/ZF2014-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-03-06T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0 allow remote attackers to cause a denial of service (CPU consumption) via (1) recursive or (2) circular references in an XML entity definition in an XML DOCTYPE declaration, aka an XML Entity Expansion (XEE) attack. NOTE: this issue exists because of an incomplete fix for CVE-2012-6532."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-11-03T18:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "[oss-security] 20140331 CVE requests: Zend Framework issues fixed in ZF2014-01 and ZF2014-02",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://seclists.org/oss-sec/2014/q2/0"
},
{
"name": "MDVSA-2014:072",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:072"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://advisories.mageia.org/MGASA-2014-0151.html"
},
{
"name": "66358",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/66358"
},
{
"name": "DSA-3265",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2015/dsa-3265"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://framework.zend.com/security/advisory/ZF2014-01"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-2683",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0 allow remote attackers to cause a denial of service (CPU consumption) via (1) recursive or (2) circular references in an XML entity definition in an XML DOCTYPE declaration, aka an XML Entity Expansion (XEE) attack. NOTE: this issue exists because of an incomplete fix for CVE-2012-6532."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[oss-security] 20140331 CVE requests: Zend Framework issues fixed in ZF2014-01 and ZF2014-02",
"refsource": "MLIST",
"url": "http://seclists.org/oss-sec/2014/q2/0"
},
{
"name": "MDVSA-2014:072",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:072"
},
{
"name": "http://advisories.mageia.org/MGASA-2014-0151.html",
"refsource": "CONFIRM",
"url": "http://advisories.mageia.org/MGASA-2014-0151.html"
},
{
"name": "66358",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/66358"
},
{
"name": "DSA-3265",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2015/dsa-3265"
},
{
"name": "http://framework.zend.com/security/advisory/ZF2014-01",
"refsource": "CONFIRM",
"url": "http://framework.zend.com/security/advisory/ZF2014-01"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-2683",
"datePublished": "2014-11-16T00:00:00",
"dateReserved": "2014-03-30T00:00:00",
"dateUpdated": "2024-08-06T10:21:36.135Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-2681 (GCVE-0-2014-2681)
Vulnerability from cvelistv5
Published
2014-11-16 00:00
Modified
2024-08-06 10:21
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0 allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, and possibly cause a denial of service (CPU and memory consumption) via an XML External Entity (XXE) attack. NOTE: this issue exists because of an incomplete fix for CVE-2012-5657.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.mandriva.com/security/advisories?name=MDVSA-2014:072 | vendor-advisory, x_refsource_MANDRIVA | |
| http://advisories.mageia.org/MGASA-2014-0151.html | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/66358 | vdb-entry, x_refsource_BID | |
| http://www.debian.org/security/2015/dsa-3265 | vendor-advisory, x_refsource_DEBIAN | |
| http://framework.zend.com/security/advisory/ZF2014-01 | x_refsource_CONFIRM | |
| http://seclists.org/oss-sec/2014/q2/0 | mailing-list, x_refsource_MLIST |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T10:21:36.060Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "MDVSA-2014:072",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:072"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://advisories.mageia.org/MGASA-2014-0151.html"
},
{
"name": "66358",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/66358"
},
{
"name": "DSA-3265",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2015/dsa-3265"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://framework.zend.com/security/advisory/ZF2014-01"
},
{
"name": "[oss-security] 20140331 Re: CVE requests: Zend Framework issues fixed in ZF2014-01 and ZF2014-02",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://seclists.org/oss-sec/2014/q2/0"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-03-06T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0 allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, and possibly cause a denial of service (CPU and memory consumption) via an XML External Entity (XXE) attack. NOTE: this issue exists because of an incomplete fix for CVE-2012-5657."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-11-03T18:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "MDVSA-2014:072",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:072"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://advisories.mageia.org/MGASA-2014-0151.html"
},
{
"name": "66358",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/66358"
},
{
"name": "DSA-3265",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2015/dsa-3265"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://framework.zend.com/security/advisory/ZF2014-01"
},
{
"name": "[oss-security] 20140331 Re: CVE requests: Zend Framework issues fixed in ZF2014-01 and ZF2014-02",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://seclists.org/oss-sec/2014/q2/0"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-2681",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0 allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, and possibly cause a denial of service (CPU and memory consumption) via an XML External Entity (XXE) attack. NOTE: this issue exists because of an incomplete fix for CVE-2012-5657."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "MDVSA-2014:072",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:072"
},
{
"name": "http://advisories.mageia.org/MGASA-2014-0151.html",
"refsource": "CONFIRM",
"url": "http://advisories.mageia.org/MGASA-2014-0151.html"
},
{
"name": "66358",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/66358"
},
{
"name": "DSA-3265",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2015/dsa-3265"
},
{
"name": "http://framework.zend.com/security/advisory/ZF2014-01",
"refsource": "CONFIRM",
"url": "http://framework.zend.com/security/advisory/ZF2014-01"
},
{
"name": "[oss-security] 20140331 Re: CVE requests: Zend Framework issues fixed in ZF2014-01 and ZF2014-02",
"refsource": "MLIST",
"url": "http://seclists.org/oss-sec/2014/q2/0"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-2681",
"datePublished": "2014-11-16T00:00:00",
"dateReserved": "2014-03-30T00:00:00",
"dateUpdated": "2024-08-06T10:21:36.060Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-2685 (GCVE-0-2014-2685)
Vulnerability from cvelistv5
Published
2014-09-04 17:00
Modified
2024-08-06 10:21
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Zend Framework 1 before 1.12.4 violate the OpenID 2.0 protocol by ensuring only that at least one field is signed, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider.
References
| ▼ | URL | Tags |
|---|---|---|
| http://seclists.org/oss-sec/2014/q2/0 | mailing-list, x_refsource_MLIST | |
| http://www.mandriva.com/security/advisories?name=MDVSA-2014:072 | vendor-advisory, x_refsource_MANDRIVA | |
| http://advisories.mageia.org/MGASA-2014-0151.html | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/66358 | vdb-entry, x_refsource_BID | |
| http://www.debian.org/security/2015/dsa-3265 | vendor-advisory, x_refsource_DEBIAN | |
| http://framework.zend.com/security/advisory/ZF2014-02 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T10:21:36.026Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[oss-security] 20140331 CVE requests: Zend Framework issues fixed in ZF2014-01 and ZF2014-02",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://seclists.org/oss-sec/2014/q2/0"
},
{
"name": "MDVSA-2014:072",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:072"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://advisories.mageia.org/MGASA-2014-0151.html"
},
{
"name": "66358",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/66358"
},
{
"name": "DSA-3265",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2015/dsa-3265"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://framework.zend.com/security/advisory/ZF2014-02"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-03-06T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Zend Framework 1 before 1.12.4 violate the OpenID 2.0 protocol by ensuring only that at least one field is signed, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-11-03T18:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "[oss-security] 20140331 CVE requests: Zend Framework issues fixed in ZF2014-01 and ZF2014-02",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://seclists.org/oss-sec/2014/q2/0"
},
{
"name": "MDVSA-2014:072",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:072"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://advisories.mageia.org/MGASA-2014-0151.html"
},
{
"name": "66358",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/66358"
},
{
"name": "DSA-3265",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2015/dsa-3265"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://framework.zend.com/security/advisory/ZF2014-02"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-2685",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Zend Framework 1 before 1.12.4 violate the OpenID 2.0 protocol by ensuring only that at least one field is signed, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[oss-security] 20140331 CVE requests: Zend Framework issues fixed in ZF2014-01 and ZF2014-02",
"refsource": "MLIST",
"url": "http://seclists.org/oss-sec/2014/q2/0"
},
{
"name": "MDVSA-2014:072",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:072"
},
{
"name": "http://advisories.mageia.org/MGASA-2014-0151.html",
"refsource": "CONFIRM",
"url": "http://advisories.mageia.org/MGASA-2014-0151.html"
},
{
"name": "66358",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/66358"
},
{
"name": "DSA-3265",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2015/dsa-3265"
},
{
"name": "http://framework.zend.com/security/advisory/ZF2014-02",
"refsource": "CONFIRM",
"url": "http://framework.zend.com/security/advisory/ZF2014-02"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-2685",
"datePublished": "2014-09-04T17:00:00",
"dateReserved": "2014-03-30T00:00:00",
"dateUpdated": "2024-08-06T10:21:36.026Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-2684 (GCVE-0-2014-2684)
Vulnerability from cvelistv5
Published
2014-11-16 00:00
Modified
2024-08-06 10:21
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Zend Framework 1 before 1.12.4 does not verify that the openid_op_endpoint value identifies the same Identity Provider as the provider used in the association handle, which allows remote attackers to bypass authentication and spoof arbitrary OpenID identities by using a malicious OpenID Provider that generates OpenID tokens with arbitrary identifier and claimed_id values.
References
| ▼ | URL | Tags |
|---|---|---|
| http://seclists.org/oss-sec/2014/q2/0 | mailing-list, x_refsource_MLIST | |
| http://www.mandriva.com/security/advisories?name=MDVSA-2014:072 | vendor-advisory, x_refsource_MANDRIVA | |
| http://advisories.mageia.org/MGASA-2014-0151.html | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/66358 | vdb-entry, x_refsource_BID | |
| http://www.debian.org/security/2015/dsa-3265 | vendor-advisory, x_refsource_DEBIAN | |
| http://framework.zend.com/security/advisory/ZF2014-02 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T10:21:36.004Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[oss-security] 20140331 CVE requests: Zend Framework issues fixed in ZF2014-01 and ZF2014-02",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://seclists.org/oss-sec/2014/q2/0"
},
{
"name": "MDVSA-2014:072",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:072"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://advisories.mageia.org/MGASA-2014-0151.html"
},
{
"name": "66358",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/66358"
},
{
"name": "DSA-3265",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2015/dsa-3265"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://framework.zend.com/security/advisory/ZF2014-02"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-03-06T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Zend Framework 1 before 1.12.4 does not verify that the openid_op_endpoint value identifies the same Identity Provider as the provider used in the association handle, which allows remote attackers to bypass authentication and spoof arbitrary OpenID identities by using a malicious OpenID Provider that generates OpenID tokens with arbitrary identifier and claimed_id values."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-11-03T18:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "[oss-security] 20140331 CVE requests: Zend Framework issues fixed in ZF2014-01 and ZF2014-02",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://seclists.org/oss-sec/2014/q2/0"
},
{
"name": "MDVSA-2014:072",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:072"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://advisories.mageia.org/MGASA-2014-0151.html"
},
{
"name": "66358",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/66358"
},
{
"name": "DSA-3265",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2015/dsa-3265"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://framework.zend.com/security/advisory/ZF2014-02"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-2684",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Zend Framework 1 before 1.12.4 does not verify that the openid_op_endpoint value identifies the same Identity Provider as the provider used in the association handle, which allows remote attackers to bypass authentication and spoof arbitrary OpenID identities by using a malicious OpenID Provider that generates OpenID tokens with arbitrary identifier and claimed_id values."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[oss-security] 20140331 CVE requests: Zend Framework issues fixed in ZF2014-01 and ZF2014-02",
"refsource": "MLIST",
"url": "http://seclists.org/oss-sec/2014/q2/0"
},
{
"name": "MDVSA-2014:072",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:072"
},
{
"name": "http://advisories.mageia.org/MGASA-2014-0151.html",
"refsource": "CONFIRM",
"url": "http://advisories.mageia.org/MGASA-2014-0151.html"
},
{
"name": "66358",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/66358"
},
{
"name": "DSA-3265",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2015/dsa-3265"
},
{
"name": "http://framework.zend.com/security/advisory/ZF2014-02",
"refsource": "CONFIRM",
"url": "http://framework.zend.com/security/advisory/ZF2014-02"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-2684",
"datePublished": "2014-11-16T00:00:00",
"dateReserved": "2014-03-30T00:00:00",
"dateUpdated": "2024-08-06T10:21:36.004Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-2682 (GCVE-0-2014-2682)
Vulnerability from cvelistv5
Published
2014-11-16 00:00
Modified
2024-08-06 10:21
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0, when PHP-FPM is used, does not properly share the libxml_disable_entity_loader setting between threads, which might allow remote attackers to conduct XML External Entity (XXE) attacks via an XML external entity declaration in conjunction with an entity reference. NOTE: this issue exists because of an incomplete fix for CVE-2012-5657.
References
| ▼ | URL | Tags |
|---|---|---|
| http://seclists.org/oss-sec/2014/q2/0 | mailing-list, x_refsource_MLIST | |
| http://www.mandriva.com/security/advisories?name=MDVSA-2014:072 | vendor-advisory, x_refsource_MANDRIVA | |
| http://advisories.mageia.org/MGASA-2014-0151.html | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/66358 | vdb-entry, x_refsource_BID | |
| http://www.debian.org/security/2015/dsa-3265 | vendor-advisory, x_refsource_DEBIAN | |
| http://framework.zend.com/security/advisory/ZF2014-01 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T10:21:36.052Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[oss-security] 20140331 CVE requests: Zend Framework issues fixed in ZF2014-01 and ZF2014-02",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://seclists.org/oss-sec/2014/q2/0"
},
{
"name": "MDVSA-2014:072",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:072"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://advisories.mageia.org/MGASA-2014-0151.html"
},
{
"name": "66358",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/66358"
},
{
"name": "DSA-3265",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2015/dsa-3265"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://framework.zend.com/security/advisory/ZF2014-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-03-06T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0, when PHP-FPM is used, does not properly share the libxml_disable_entity_loader setting between threads, which might allow remote attackers to conduct XML External Entity (XXE) attacks via an XML external entity declaration in conjunction with an entity reference. NOTE: this issue exists because of an incomplete fix for CVE-2012-5657."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-11-03T18:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "[oss-security] 20140331 CVE requests: Zend Framework issues fixed in ZF2014-01 and ZF2014-02",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://seclists.org/oss-sec/2014/q2/0"
},
{
"name": "MDVSA-2014:072",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:072"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://advisories.mageia.org/MGASA-2014-0151.html"
},
{
"name": "66358",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/66358"
},
{
"name": "DSA-3265",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2015/dsa-3265"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://framework.zend.com/security/advisory/ZF2014-01"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-2682",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0, when PHP-FPM is used, does not properly share the libxml_disable_entity_loader setting between threads, which might allow remote attackers to conduct XML External Entity (XXE) attacks via an XML external entity declaration in conjunction with an entity reference. NOTE: this issue exists because of an incomplete fix for CVE-2012-5657."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[oss-security] 20140331 CVE requests: Zend Framework issues fixed in ZF2014-01 and ZF2014-02",
"refsource": "MLIST",
"url": "http://seclists.org/oss-sec/2014/q2/0"
},
{
"name": "MDVSA-2014:072",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:072"
},
{
"name": "http://advisories.mageia.org/MGASA-2014-0151.html",
"refsource": "CONFIRM",
"url": "http://advisories.mageia.org/MGASA-2014-0151.html"
},
{
"name": "66358",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/66358"
},
{
"name": "DSA-3265",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2015/dsa-3265"
},
{
"name": "http://framework.zend.com/security/advisory/ZF2014-01",
"refsource": "CONFIRM",
"url": "http://framework.zend.com/security/advisory/ZF2014-01"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-2682",
"datePublished": "2014-11-16T00:00:00",
"dateReserved": "2014-03-30T00:00:00",
"dateUpdated": "2024-08-06T10:21:36.052Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}