{"id":"GHSA-pw5c-xqf2-6xc2","summary":"Doctrine Security Misconfiguration Vulnerability","details":"Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before 1.0.2, and MongoDB ODM Bundle before 3.0.1 use world-writable permissions for cache directories, which allows local users to execute arbitrary PHP code with additional privileges by leveraging an application with the umask set to 0 and that executes cache entries as code.","aliases":["CVE-2015-5723"],"modified":"2024-11-30T05:31:48.365402Z","published":"2022-05-17T03:44:28Z","database_specific":{"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2023-10-19T19:12:06Z","nvd_published_at":"2016-06-07T14:06:00Z","cwe_ids":[]},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5723"},{"type":"WEB","url":"https://framework.zend.com/security/advisory/ZF2015-07"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/aws/aws-sdk-php/CVE-2015-5723.yaml"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/doctrine/cache/CVE-2015-5723.yaml"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/doctrine/orm/CVE-2015-5723.yaml"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zend-cache/CVE-2015-5723.yaml"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/CVE-2015-5723.yaml"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/CVE-2015-5723.yaml"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/zfcampus/zf-apigility-doctrine/CVE-2015-5723.yaml"},{"type":"WEB","url":"https://github.com/aws/aws-sdk-php/releases/tag/3.2.1"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2IUUC7HPN4XE5NNTG4MR76OC662XRZUO"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HPS7A54FQ2CR6PH4NDR6UIYJIRNFXW67"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2IUUC7HPN4XE5NNTG4MR76OC662XRZUO"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HPS7A54FQ2CR6PH4NDR6UIYJIRNFXW67"},{"type":"WEB","url":"https://www.doctrine-project.org/2015/08/31/security_misconfiguration_vulnerability_in_various_doctrine_projects.html"},{"type":"WEB","url":"http://framework.zend.com/security/advisory/ZF2015-07"},{"type":"WEB","url":"http://www.debian.org/security/2015/dsa-3369"},{"type":"WEB","url":"http://www.doctrine-project.org/2015/08/31/security_misconfiguration_vulnerability_in_various_doctrine_projects.html"}],"affected":[{"package":{"name":"doctrine/annotations","ecosystem":"Packagist","purl":"pkg:composer/doctrine/annotations"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.7"}]}],"versions":["v1.0","v1.1","v1.1.1","v1.1.2","v1.2.0","v1.2.1","v1.2.2","v1.2.3","v1.2.4","v1.2.5","v1.2.6"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-pw5c-xqf2-6xc2/GHSA-pw5c-xqf2-6xc2.json"}},{"package":{"name":"doctrine/cache","ecosystem":"Packagist","purl":"pkg:composer/doctrine/cache"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"fixed":"1.4.2"}]}],"versions":["v1.4.0","v1.4.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-pw5c-xqf2-6xc2/GHSA-pw5c-xqf2-6xc2.json"}},{"package":{"name":"doctrine/common","ecosystem":"Packagist","purl":"pkg:composer/doctrine/common"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3"}]}],"versions":["2.1.3","2.1.4","2.2.0","2.2.0-RC1","2.2.0-RC3","2.2.0-RC4","2.2.0-RC5","2.2.0BETA1","2.2.0BETA2","2.2.1","2.2.2","2.2.3","2.3.0","2.3.0-BETA1","2.3.0-RC1","2.3.0-RC2","2.3.0-RC3","2.4.0-RC1","2.4.0-RC2","2.4.0-RC3","2.4.0-RC4","v2.4.0","v2.4.1","v2.4.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-pw5c-xqf2-6xc2/GHSA-pw5c-xqf2-6xc2.json"}},{"package":{"name":"doctrine/common","ecosystem":"Packagist","purl":"pkg:composer/doctrine/common"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0-stable"},{"fixed":"2.5.1"}]}],"versions":["v2.5.0","v2.5.0-beta1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-pw5c-xqf2-6xc2/GHSA-pw5c-xqf2-6xc2.json"}},{"package":{"name":"doctrine/orm","ecosystem":"Packagist","purl":"pkg:composer/doctrine/orm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.5.1"}]}],"versions":["v2.5.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-pw5c-xqf2-6xc2/GHSA-pw5c-xqf2-6xc2.json"}},{"package":{"name":"doctrine/mongodb-odm","ecosystem":"Packagist","purl":"pkg:composer/doctrine/mongodb-odm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2"}]}],"versions":["1.0.0","1.0.0-BETA10","1.0.0-BETA11","1.0.0-BETA12","1.0.0-BETA13","1.0.0-BETA4","1.0.0-BETA5","1.0.0-BETA6","1.0.0-BETA7","1.0.0-BETA8","1.0.0-BETA9","1.0.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-pw5c-xqf2-6xc2/GHSA-pw5c-xqf2-6xc2.json"}},{"package":{"name":"doctrine/mongodb-odm-bundle","ecosystem":"Packagist","purl":"pkg:composer/doctrine/mongodb-odm-bundle"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1"}]}],"versions":["v2.0.1","v2.1.0","v2.2.0","v2.2.1","v3.0.0","v3.0.0-BETA1","v3.0.0-BETA2","v3.0.0-BETA3","v3.0.0-BETA4","v3.0.0-BETA5","v3.0.0-BETA6"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-pw5c-xqf2-6xc2/GHSA-pw5c-xqf2-6xc2.json"}},{"package":{"name":"zendframework/zendframework1","ecosystem":"Packagist","purl":"pkg:composer/zendframework/zendframework1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"1.12.16"}]}],"versions":["1.12.0","1.12.1","1.12.10","1.12.11","1.12.12","1.12.13","1.12.14","1.12.15","1.12.2","1.12.3","1.12.4","1.12.5","1.12.6","1.12.7","1.12.8","1.12.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-pw5c-xqf2-6xc2/GHSA-pw5c-xqf2-6xc2.json"}},{"package":{"name":"zendframework/zend-cache","ecosystem":"Packagist","purl":"pkg:composer/zendframework/zend-cache"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.5.3"}]}],"versions":["2.5.0","2.5.1","2.5.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-pw5c-xqf2-6xc2/GHSA-pw5c-xqf2-6xc2.json"}},{"package":{"name":"aws/aws-sdk-php","ecosystem":"Packagist","purl":"pkg:composer/aws/aws-sdk-php"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.2.1"}]}],"versions":["3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.1.0","3.2.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-pw5c-xqf2-6xc2/GHSA-pw5c-xqf2-6xc2.json"}},{"package":{"name":"doctrine/cache","ecosystem":"Packagist","purl":"pkg:composer/doctrine/cache"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.3.2"}]}],"versions":["v1.1","v1.2.0","v1.3.0","v1.3.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-pw5c-xqf2-6xc2/GHSA-pw5c-xqf2-6xc2.json"}},{"package":{"name":"zendframework/zend-cache","ecosystem":"Packagist","purl":"pkg:composer/zendframework/zend-cache"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.8"}]}],"versions":["2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.4.5","2.4.6","2.4.7"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-pw5c-xqf2-6xc2/GHSA-pw5c-xqf2-6xc2.json"}},{"package":{"name":"zendframework/zendframework","ecosystem":"Packagist","purl":"pkg:composer/zendframework/zendframework"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.8"}]}],"versions":["2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.4.5","2.4.6","2.4.7"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-pw5c-xqf2-6xc2/GHSA-pw5c-xqf2-6xc2.json"}},{"package":{"name":"zfcampus/zf-apigility-doctrine","ecosystem":"Packagist","purl":"pkg:composer/zfcampus/zf-apigility-doctrine"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.0.3"}]}],"versions":["1.0.0","1.0.1","1.0.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-pw5c-xqf2-6xc2/GHSA-pw5c-xqf2-6xc2.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}