Vulnerabilities > CVE-2021-3007 - Deserialization of Untrusted Data vulnerability in multiple products

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

getlaminas

zend

CWE-502

critical

NVD

Published: 2021-01-04

Updated: 2024-08-03

Summary

Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the __destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: Zend Framework is no longer supported by the maintainer. NOTE: the laminas-http vendor considers this a "vulnerability in the PHP language itself" but has added certain type checking as a way to prevent exploitation in (unrecommended) use cases where attacker-supplied data can be deserialized

Vulnerable Configurations

Part	Description	Count
Application	Getlaminas Getlaminas Laminas Http - Getlaminas Laminas Http 2.0.0 Getlaminas Laminas Http 2.0.1 Getlaminas Laminas Http 2.0.2 Getlaminas Laminas Http 2.0.3 Getlaminas Laminas Http 2.0.4 Getlaminas Laminas Http 2.0.5 Getlaminas Laminas Http 2.0.6 Getlaminas Laminas Http 2.0.7 Getlaminas Laminas Http 2.0.8 Getlaminas Laminas Http 2.1.0 Getlaminas Laminas Http 2.1.1 Getlaminas Laminas Http 2.1.2 Getlaminas Laminas Http 2.1.3 Getlaminas Laminas Http 2.1.4 Getlaminas Laminas Http 2.1.5 Getlaminas Laminas Http 2.1.6 Getlaminas Laminas Http 2.2.0 Getlaminas Laminas Http 2.2.1 Getlaminas Laminas Http 2.2.2 Getlaminas Laminas Http 2.2.3 Getlaminas Laminas Http 2.2.4 Getlaminas Laminas Http 2.2.5 Getlaminas Laminas Http 2.2.6 Getlaminas Laminas Http 2.2.7 Getlaminas Laminas Http 2.2.8 Getlaminas Laminas Http 2.2.9 Getlaminas Laminas Http 2.2.10 Getlaminas Laminas Http 2.3.0 Getlaminas Laminas Http 2.3.1 Getlaminas Laminas Http 2.3.2 Getlaminas Laminas Http 2.3.3 Getlaminas Laminas Http 2.3.4 Getlaminas Laminas Http 2.3.5 Getlaminas Laminas Http 2.3.6 Getlaminas Laminas Http 2.3.7 Getlaminas Laminas Http 2.3.8 Getlaminas Laminas Http 2.3.9 Getlaminas Laminas Http 2.4.0 Getlaminas Laminas Http 2.4.1 Getlaminas Laminas Http 2.4.2 Getlaminas Laminas Http 2.4.3 Getlaminas Laminas Http 2.4.4 Getlaminas Laminas Http 2.4.5 Getlaminas Laminas Http 2.4.6 Getlaminas Laminas Http 2.4.7 Getlaminas Laminas Http 2.4.8 Getlaminas Laminas Http 2.4.9 Getlaminas Laminas Http 2.4.10 Getlaminas Laminas Http 2.4.11 Getlaminas Laminas Http 2.4.12 Getlaminas Laminas Http 2.4.13 Getlaminas Laminas Http 2.5.0 Getlaminas Laminas Http 2.5.1 Getlaminas Laminas Http 2.5.2 Getlaminas Laminas Http 2.5.3 Getlaminas Laminas Http 2.5.4 Getlaminas Laminas Http 2.5.5 Getlaminas Laminas Http 2.5.6 Getlaminas Laminas Http 2.6.0 Getlaminas Laminas Http 2.7.0 Getlaminas Laminas Http 2.8.0 Getlaminas Laminas Http 2.8.1 Getlaminas Laminas Http 2.8.2 Getlaminas Laminas Http 2.8.3 Getlaminas Laminas Http 2.8.4 Getlaminas Laminas Http 2.9.0 Getlaminas Laminas Http 2.9.1 Getlaminas Laminas Http 2.10.0 Getlaminas Laminas Http 2.10.1 Getlaminas Laminas Http 2.11.0 Getlaminas Laminas Http 2.11.1 Getlaminas Laminas Http 2.11.2 Getlaminas Laminas Http 2.11.3 Getlaminas Laminas Http 2.12.0 Getlaminas Laminas Http 2.13.0 Getlaminas Laminas Http 2.14.0 Getlaminas Laminas Http 2.14.1	88
Application	Zend Zend Zend Framework 3.0.0	1

Common Weakness Enumeration (CWE)

CWE-502 - Deserialization of Untrusted Data

Vulnerabilities > CVE-2021-3007 - Deserialization of Untrusted Data vulnerability in multiple products

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Related news

References