CVE-2015-7503 - OpenCVE

Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remote attackers to recover the RSA private key.

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

AV:N/AC:L/Au:N/C:P/I:N/A:N

Vendors & Products
CPE Configurations

Vendors	Products
Zend	Zend Framework

Configuration 1 [-]

OR	cpe:2.3:a:zend:zend_framework:2.4.0:::::::*
	cpe:2.3:a:zend:zend_framework:2.4.1:::::::*
	cpe:2.3:a:zend:zend_framework:2.4.2:::::::*
	cpe:2.3:a:zend:zend_framework:2.4.3:::::::*
	cpe:2.3:a:zend:zend_framework:2.4.4:::::::*
	cpe:2.3:a:zend:zend_framework:2.4.5:::::::*
	cpe:2.3:a:zend:zend_framework:2.4.6:::::::*
	cpe:2.3:a:zend:zend_framework:2.4.7:::::::*
	cpe:2.3:a:zend:zend_framework:2.4.8:::::::*
	cpe:2.3:a:zend:zend_framework:2.5.0:::::::*
	cpe:2.3:a:zend:zend_framework:2.5.1:::::::*

References

Link	Resource
https://bugzilla.redhat.com/show_bug.cgi?id=1283137	Issue Tracking Third Party Advisory
https://framework.zend.com/security/advisory/ZF2015-10	Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: redhat

Published: 2017-10-10T16:00:00

Updated: 2017-10-10T15:57:01

Reserved: 2015-09-29T00:00:00

Link: CVE-2015-7503

JSON object: View

NVD Information

Status : Analyzed

Published: 2017-10-10T16:29:00.480

Modified: 2017-11-05T21:23:35.763

Link: CVE-2015-7503

JSON object: View

Redhat Information

No data.

CWE

CWE-320

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:zend:zend_framework:2.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "8CE2C2D7-D937-427B-9690-B1EA32314042", "vulnerable": true}, {"criteria": "cpe:2.3:a:zend:zend_framework:2.4.1:*:*:*:*:*:*:*", "matchCriteriaId": "98145CC7-4F7E-40B2-BDD3-08AF81634AF7", "vulnerable": true}, {"criteria": "cpe:2.3:a:zend:zend_framework:2.4.2:*:*:*:*:*:*:*", "matchCriteriaId": "35909C93-F7B3-4072-9FB7-E806AFDB585C", "vulnerable": true}, {"criteria": "cpe:2.3:a:zend:zend_framework:2.4.3:*:*:*:*:*:*:*", "matchCriteriaId": "F8AFDDAC-A697-4F0C-9C1B-507A85DF8473", "vulnerable": true}, {"criteria": "cpe:2.3:a:zend:zend_framework:2.4.4:*:*:*:*:*:*:*", "matchCriteriaId": "1F724D0C-0A0D-48A0-AE0B-A9645062AEF6", "vulnerable": true}, {"criteria": "cpe:2.3:a:zend:zend_framework:2.4.5:*:*:*:*:*:*:*", "matchCriteriaId": "0BC1E6B1-1456-419E-9711-10EAD142FE6F", "vulnerable": true}, {"criteria": "cpe:2.3:a:zend:zend_framework:2.4.6:*:*:*:*:*:*:*", "matchCriteriaId": "5CAF7D7C-EB8C-4EF7-BBAE-4D7E86FD8F2A", "vulnerable": true}, {"criteria": "cpe:2.3:a:zend:zend_framework:2.4.7:*:*:*:*:*:*:*", "matchCriteriaId": "2C6BBE4F-3EC6-415E-92DF-5663DD54D489", "vulnerable": true}, {"criteria": "cpe:2.3:a:zend:zend_framework:2.4.8:*:*:*:*:*:*:*", "matchCriteriaId": "DA57B38C-E022-4C07-99DA-9C6824FB42C5", "vulnerable": true}, {"criteria": "cpe:2.3:a:zend:zend_framework:2.5.0:*:*:*:*:*:*:*", "matchCriteriaId": "A8CF6A3D-A182-4800-89FA-44BC4ACD7291", "vulnerable": true}, {"criteria": "cpe:2.3:a:zend:zend_framework:2.5.1:*:*:*:*:*:*:*", "matchCriteriaId": "FCDA71DB-7D92-47EC-A706-2A61ACDC7CEB", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remote attackers to recover the RSA private key."}, {"lang": "es", "value": "Zend Framework en versiones anteriores a la 2.4.9, zend-framework/zend-crypt en versiones 2.4.x anteriores a la 2.4.9 y 2.5.x anteriores a la 2.5.2 permite que atacantes remotos recuperen la clave privada RSA."}], "id": "CVE-2015-7503", "lastModified": "2017-11-05T21:23:35.763", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-10-10T16:29:00.480", "references": [{"source": "secalert@redhat.com", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1283137"}, {"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "https://framework.zend.com/security/advisory/ZF2015-10"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-320"}], "source": "nvd@nist.gov", "type": "Primary"}]}