CVE-2020-29312

Katalog CVE

CVSS 9.8 · Critical EPSS 1,3%

Kerentanan Deserialization of Untrusted Data pada zend framework. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

An issue found in Zend Framework v.3.1.3 and before allow a remote attacker to execute arbitrary code via the unserialize function. Note: This has been disputed by third parties as incomplete and incorrect. The framework does not have a version that surpasses 2.x.x and was deprecated in early 2020.

Rincian

Terbit di NVD

4 April 2023

Terakhir diubah

9 Juli 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

1,3% peluang dieksploitasi; lebih tinggi dari 68,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://cowtransfer.com/s/f9684f004d7149 broken link
• https://github.com/zendframework/zendframework product