CVE-2015-7503 — Sensitive Information Exposure in Zend-crypt

CWE-320CWE-200 — Sensitive Information Exposure7 documents5 sources
Severity
7.5HIGHNVD
EPSS
0.2%
top 51.78%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Zendframework Zend-cryptZendframeworkZend Framework
Timeline
PublishedOct 10
Latest updateMay 17

Description

Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remote attackers to recover the RSA private key.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶Packagistzendframework/zend-crypt2.0.0 — 2.4.9+1
▶Packagistzendframework/zendframework2.5.0 — 2.5.2+1
▶NVDzend/zend_framework11 versions+10

🔴Vulnerability Details

3
OSV
Zend Framework Information Disclosure↗2022-05-17
▶
GHSA
Zend Framework Information Disclosure↗2022-05-17
▶
CVEList
CVE-2015-7503: Zend Framework before 2↗2017-10-10
▶

💬Community

3
Bugzilla
CVE-2015-7503 php-ZendFramework2: Usage of vulnerable PKCS#1 v1.5 padding allows to recover RSA private key [epel-all]↗2015-12-07
▶
Bugzilla
CVE-2015-7503 php-ZendFramework2: Usage of vulnerable PKCS#1 v1.5 padding allows to recover RSA private key [fedora-all]↗2015-12-07
▶
Bugzilla
CVE-2015-7503 php-ZendFramework2: Usage of vulnerable PKCS#1 v1.5 padding allows to recover RSA private key↗2015-11-18
▶
CVE-2015-7503 — Sensitive Information Exposure | cvebase