Remote Code Execution vuln in Zend Framework 3.0.0

Common Vulnerabilities and Exposures

January 4, 2021

Rajaneesh

Overview :

Remote Code Execution vuln in Zend Framework 3.0.0

Affected Product(s) :

Zend Framework 3.0.0

Vulnerability Details :

CVE ID :

CVE-2021-3007

Zend Framework 3.0.0 has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the __destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: the code may be related to Laminas Project laminas-http. Zend Framework is no longer supported by the maintainer. However, not all Zend Framework 3.0.0 vulnerabilities exist in a Laminas Project release.

Solution :

Upgrade to latest version.

CVE-2021-3007 Zend Framework 3.0.0

Advanced Machine Learning Based Cloud Security Solution

The Prophaze WAF can be deployed in any Public cloud such as AWS, GCP, Azure, Digital Ocean and on Private Cloud instance like Microk8s

100%

The security of your details is important to us. Prophaze Technologies collects a variety of data that you provide directly to us. The types of data we gather will depend upon the services you use, how you use them, and what you choose to provide. We process your details when necessary to provide you with the services that you have requested when accepting our Terms of Services or when we have the legitimate interest(security, testing, analytics, and so on) to do so please checkout our page.

Demo Request Form

100% Advanced Machine Learning Based Bot Management Solution

Demo Request Form

Remote Code Execution vuln in Zend Framework 3.0.0

Getting Started

Use Cases

WAF Automation

Contact Us