NetSight
IP …
high7.8

CVE-2015-5723

Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.…

Impact

Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before 1.0.2, and MongoDB ODM Bundle before 3.0.1 use world-writable permissions for cache directories, which allows local users to execute arbitrary PHP code with additional privileges by leveraging an application with the umask set to 0 and that executes cache entries as code.

Affected products

VendorProductAffected versions
ZendZend-Cache
through 2.4.7
Versions 2.5.0, 2.5.1, 2.5.2
DebianDebian Linux
Versions 7.0, 8.0
Doctrine-ProjectObject Relational Mapper
through 2.4.7
Version 2.5.0
Doctrine-ProjectDoctrinemongodbbundle
Version 3.0.0
ZendZend Framework
through 2.4.7
through 1.12.15
Doctrine-ProjectCommon
through 2.4.2
Version 2.5.0
Doctrine-ProjectAnnotations
through 1.2.6
Doctrine-ProjectMongodb-Odm
through 1.0.1
Doctrine-ProjectCache
through 1.3.1
Versions 1.4.0, 1.4.1
ZendZf-Apigility-Doctrine
through 1.0.2

Weakness classification

CWE-264

References