CVE-2021-3007

Katalog CVE

CVSS 9.8 · Critical EPSS 75,3%

Kerentanan Deserialization of Untrusted Data pada getlaminas laminas-http, zend framework. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the __destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: Zend Framework is no longer supported by the maintainer. NOTE: the laminas-http vendor considers this a "vulnerability in the PHP language itself" but has added certain type checking as a way to prevent exploitation in (unrecommended) use cases where attacker-supplied data can be deserialized

Rincian

Terbit di NVD

4 Januari 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

75,3% peluang dieksploitasi; lebih tinggi dari 99,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/laminas/laminas-http/commits/2.15.x/src/Response/Stream.php patch · advisory pihak ketiga
• https://github.com/laminas/laminas-http/pull/48 patch · advisory pihak ketiga
• https://github.com/Ling-Yizhou/zendframework3-/blob/main/zend%20framework3%20%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C... exploit · advisory pihak ketiga
• https://github.com/laminas/laminas-http/releases/tag/2.14.2 advisory pihak ketiga
• https://research.checkpoint.com/2021/freakout-leveraging-newest-vulnerabilities-for-creating-a-botnet/ exploit · advisory pihak ketiga