{"action":"Upgrade zendframework/zendframework to 1.12.14 or later.","affected":[{"fixed":"2.4.6","introduced":"2.0.0"},{"fixed":"2.5.2","introduced":"2.5.0"},{"fixed":"1.12.14","introduced":"1.12.0"}],"component":"zendframework/zendframework","cve_ids":["CVE-2015-5161"],"ecosystem":"Packagist","epss":0.09867,"exploited":false,"fixed_versions":["2.4.6","2.5.2","1.12.14"],"ghsa_id":"GHSA-xp8p-9rq5-4wgv","id":"tcs_01M5KFB7D8JS4Y2X1YWEBFZP1C","modified_at":"2024-12-04T05:40:31.935654Z","published_at":"2022-05-17T03:16:37Z","references":["https://osv.dev/vulnerability/GHSA-xp8p-9rq5-4wgv","https://nvd.nist.gov/vuln/detail/CVE-2015-5161","https://github.com/zendframework/zf1/issues/393","https://github.com/zendframework/ZendXml/commit/79f478fa2af85ce1fc18ac132dee5aa714c3b532","https://github.com/zendframework/zf1/commit/ff7edddf1410b44b5ead857c02698aad9f748d1b","https://framework.zend.com/security/advisory/ZF2015-06","https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/CVE-2015-5161.yaml","https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/CVE-2015-5161.yaml","https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendxml/CVE-2015-5161.yaml","https://web.archive.org/web/20200228055156/http://www.securityfocus.com/bid/76177","https://www.exploit-db.com/exploits/37765","http://framework.zend.com/security/advisory/ZF2015-06","http://legalhackers.com/advisories/zend-framework-XXE-vuln.txt","http://lists.fedoraproject.org/pipermail/package-announce/2015-August/164409.html","http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165147.html","http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165173.html","http://packetstormsecurity.com/files/133068/Zend-Framework-2.4.2-1.12.13-XXE-Injection.html","http://seclists.org/fulldisclosure/2015/Aug/46","http://www.debian.org/security/2015/dsa-3340","http://www.securityfocus.com/bid/76177"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-xp8p-9rq5-4wgv","url":"https://osv.dev/vulnerability/GHSA-xp8p-9rq5-4wgv"}],"summary":"ZendXml and Zend Framework contain XXE and XEE Vulnerabilities"}