{"id":"GHSA-pw5c-xqf2-6xc2","aliases":["CVE-2015-5723"],"title":"Doctrine Security Misconfiguration Vulnerability","description":"Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before 1.0.2, and MongoDB ODM Bundle before 3.0.1 use world-writable permissions for cache directories, which allows local users to execute arbitrary PHP code with additional privileges by leveraging an application with the umask set to 0 and that executes cache entries as code.","severity":"high","score":7.8,"published":"2022-05-17T03:44:28.000Z","modified":"2024-11-30T05:31:48.365Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"doctrine/annotations","ranges":[{"events":[{"introduced":"0"},{"fixed":"1.2.7"}],"type":"ECOSYSTEM"}],"versions":["v1.0","v1.1","v1.1.1","v1.1.2","v1.2.0","v1.2.1","v1.2.2","v1.2.3","v1.2.4","v1.2.5","v1.2.6"],"fixed":["1.2.7"]},{"ecosystem":"Packagist","name":"doctrine/cache","ranges":[{"events":[{"introduced":"1.4.0"},{"fixed":"1.4.2"}],"type":"ECOSYSTEM"}],"versions":["v1.4.0","v1.4.1"],"fixed":["1.4.2"]},{"ecosystem":"Packagist","name":"doctrine/common","ranges":[{"events":[{"introduced":"0"},{"fixed":"2.4.3"}],"type":"ECOSYSTEM"}],"versions":["2.1.3","2.1.4","2.2.0","2.2.0-RC1","2.2.0-RC3","2.2.0-RC4","2.2.0-RC5","2.2.0BETA1","2.2.0BETA2","2.2.1","2.2.2","2.2.3","2.3.0","2.3.0-BETA1","2.3.0-RC1","2.3.0-RC2","2.3.0-RC3","2.4.0-RC1","2.4.0-RC2","2.4.0-RC3","2.4.0-RC4","v2.4.0","v2.4.1","v2.4.2"],"fixed":["2.4.3"]},{"ecosystem":"Packagist","name":"doctrine/common","ranges":[{"events":[{"introduced":"2.5.0-stable"},{"fixed":"2.5.1"}],"type":"ECOSYSTEM"}],"versions":["v2.5.0","v2.5.0-beta1"],"fixed":["2.5.1"]},{"ecosystem":"Packagist","name":"doctrine/orm","ranges":[{"events":[{"introduced":"2.5.0"},{"fixed":"2.5.1"}],"type":"ECOSYSTEM"}],"versions":["v2.5.0"],"fixed":["2.5.1"]},{"ecosystem":"Packagist","name":"doctrine/mongodb-odm","ranges":[{"events":[{"introduced":"0"},{"fixed":"1.0.2"}],"type":"ECOSYSTEM"}],"versions":["1.0.0","1.0.0-BETA10","1.0.0-BETA11","1.0.0-BETA12","1.0.0-BETA13","1.0.0-BETA4","1.0.0-BETA5","1.0.0-BETA6","1.0.0-BETA7","1.0.0-BETA8","1.0.0-BETA9","1.0.1"],"fixed":["1.0.2"]},{"ecosystem":"Packagist","name":"doctrine/mongodb-odm-bundle","ranges":[{"events":[{"introduced":"0"},{"fixed":"3.0.1"}],"type":"ECOSYSTEM"}],"versions":["v2.0.1","v2.1.0","v2.2.0","v2.2.1","v3.0.0","v3.0.0-BETA1","v3.0.0-BETA2","v3.0.0-BETA3","v3.0.0-BETA4","v3.0.0-BETA5","v3.0.0-BETA6"],"fixed":["3.0.1"]},{"ecosystem":"Packagist","name":"zendframework/zendframework1","ranges":[{"events":[{"introduced":"1.12.0"},{"fixed":"1.12.16"}],"type":"ECOSYSTEM"}],"versions":["1.12.0","1.12.1","1.12.10","1.12.11","1.12.12","1.12.13","1.12.14","1.12.15","1.12.2","1.12.3","1.12.4","1.12.5","1.12.6","1.12.7","1.12.8","1.12.9"],"fixed":["1.12.16"]},{"ecosystem":"Packagist","name":"zendframework/zend-cache","ranges":[{"events":[{"introduced":"2.5.0"},{"fixed":"2.5.3"}],"type":"ECOSYSTEM"}],"versions":["2.5.0","2.5.1","2.5.2"],"fixed":["2.5.3"]},{"ecosystem":"Packagist","name":"aws/aws-sdk-php","ranges":[{"events":[{"introduced":"3.0.0"},{"fixed":"3.2.1"}],"type":"ECOSYSTEM"}],"versions":["3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.1.0","3.2.0"],"fixed":["3.2.1"]},{"ecosystem":"Packagist","name":"doctrine/cache","ranges":[{"events":[{"introduced":"1.0.0"},{"fixed":"1.3.2"}],"type":"ECOSYSTEM"}],"versions":["v1.1","v1.2.0","v1.3.0","v1.3.1"],"fixed":["1.3.2"]},{"ecosystem":"Packagist","name":"zendframework/zend-cache","ranges":[{"events":[{"introduced":"2.4.0"},{"fixed":"2.4.8"}],"type":"ECOSYSTEM"}],"versions":["2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.4.5","2.4.6","2.4.7"],"fixed":["2.4.8"]},{"ecosystem":"Packagist","name":"zendframework/zendframework","ranges":[{"events":[{"introduced":"2.4.0"},{"fixed":"2.4.8"}],"type":"ECOSYSTEM"}],"versions":["2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.4.5","2.4.6","2.4.7"],"fixed":["2.4.8"]},{"ecosystem":"Packagist","name":"zfcampus/zf-apigility-doctrine","ranges":[{"events":[{"introduced":"1.0.0"},{"fixed":"1.0.3"}],"type":"ECOSYSTEM"}],"versions":["1.0.0","1.0.1","1.0.2"],"fixed":["1.0.3"]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2015-5723","https://framework.zend.com/security/advisory/ZF2015-07","https://github.com/FriendsOfPHP/security-advisories/blob/master/aws/aws-sdk-php/CVE-2015-5723.yaml","https://github.com/FriendsOfPHP/security-advisories/blob/master/doctrine/cache/CVE-2015-5723.yaml","https://github.com/FriendsOfPHP/security-advisories/blob/master/doctrine/orm/CVE-2015-5723.yaml","https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zend-cache/CVE-2015-5723.yaml","https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/CVE-2015-5723.yaml","https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/CVE-2015-5723.yaml","https://github.com/FriendsOfPHP/security-advisories/blob/master/zfcampus/zf-apigility-doctrine/CVE-2015-5723.yaml","https://github.com/aws/aws-sdk-php/releases/tag/3.2.1","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2IUUC7HPN4XE5NNTG4MR76OC662XRZUO","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HPS7A54FQ2CR6PH4NDR6UIYJIRNFXW67","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2IUUC7HPN4XE5NNTG4MR76OC662XRZUO","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HPS7A54FQ2CR6PH4NDR6UIYJIRNFXW67","https://www.doctrine-project.org/2015/08/31/security_misconfiguration_vulnerability_in_various_doctrine_projects.html","http://framework.zend.com/security/advisory/ZF2015-07","http://www.debian.org/security/2015/dsa-3369","http://www.doctrine-project.org/2015/08/31/security_misconfiguration_vulnerability_in_various_doctrine_projects.html"],"sources":[{"name":"OSV","id":"GHSA-pw5c-xqf2-6xc2","modified":"2024-11-30T05:31:48.365402Z","url":"https://osv.dev/vulnerability/GHSA-pw5c-xqf2-6xc2"}],"assessments":[{"source":"OSV","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8}]}