Back to feed
EUVD-2022-4834 · Published May 17, 2022
Doctrine Security Misconfiguration Vulnerability Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before 1.0.2, and MongoDB ODM Bundle before 3.0.1 use world-writable permissions for cache directories, which allows local users to execute arbitrary PHP code with additional privileges by leveraging an application with the umask set to 0 and that executes cache entries as code.
Technologies
Doctrine-Project Object Relational MapperDoctrine-Project Mongodb-OdmZend Zf-Apigility-DoctrineZend Zend FrameworkDoctrine-Project AnnotationsZend Zend-CacheDoctrine-Project DoctrinemongodbbundleDoctrine-Project CommonDebian Debian LinuxDoctrine-Project CacheDoctrine OrmZfcampus Zf-Apigility-DoctrineDoctrine Mongodb-Odm-BundleAws Aws-Sdk-PhpDoctrine CacheZendframework Zendframework1Zendframework ZendframeworkDoctrine CommonZendframework Zend-CacheDoctrine AnnotationsDoctrine Mongodb-Odm
Weaknesses
CWE-264
CVSS scores
- v3.07.8
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
MITRE ATT&CK
InferredWhere this vulnerability fits in an attack
Privilege Escalation
References
- http://framework.zend.com/security/advisory/ZF2015-07
- http://www.debian.org/security/2015/dsa-3369
- http://www.doctrine-project.org/2015/08/31/security_misconfiguration_vulnerability_in_various_doctrine_projects.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2IUUC7HPN4XE5NNTG4MR76OC662XRZUO/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HPS7A54FQ2CR6PH4NDR6UIYJIRNFXW67/
- https://nvd.nist.gov/vuln/detail/CVE-2015-5723
Potentially impacted assets
See if this affects your attack surface
