CVE-2015-3154 Zenario CMS vulnerable to CRLF injection
MediumCVSS 6.1
EPSS 1.0%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zendframework/zend-http(Packagist) | >= 2.0.0beta4, < 2.3.8 | 2.3.8 |
| zendframework/zend-http(Packagist) | = 2.0.3 | No fix listed |
| zendframework/zend-http(Packagist) | = 2.0.4 | No fix listed |
| zendframework/zend-http(Packagist) | = 2.0.5 | No fix listed |
| zendframework/zend-http(Packagist) | = 2.0.6 | No fix listed |
| zendframework/zend-http(Packagist) | = 2.0.7 | No fix listed |
| zendframework/zend-http(Packagist) | = 2.0.8 | No fix listed |
| zendframework/zend-http(Packagist) | = 2.1.0 | No fix listed |
| zendframework/zend-http(Packagist) | = 2.1.1 | No fix listed |
| zendframework/zend-http(Packagist) | = 2.1.2 | No fix listed |
| zendframework/zend-http(Packagist) | = 2.1.3 | No fix listed |
| zendframework/zend-http(Packagist) | = 2.1.4 | No fix listed |
| zendframework/zend-http(Packagist) | = 2.1.5 | No fix listed |
| zendframework/zend-http(Packagist) | = 2.1.6 | No fix listed |
| zendframework/zend-http(Packagist) | = 2.2.0 | No fix listed |
| zendframework/zend-http(Packagist) | = 2.2.0rc1 | No fix listed |
| zendframework/zend-http(Packagist) | = 2.2.0rc2 | No fix listed |
| zendframework/zend-http(Packagist) | = 2.2.0rc3 | No fix listed |
| zendframework/zend-http(Packagist) | = 2.2.1 | No fix listed |
| zendframework/zend-http(Packagist) | = 2.2.10 | No fix listed |
| zendframework/zend-http(Packagist) | = 2.2.2 | No fix listed |
| zendframework/zend-http(Packagist) | = 2.2.3 | No fix listed |
| zendframework/zend-http(Packagist) | = 2.2.4 | No fix listed |
| zendframework/zend-http(Packagist) | = 2.2.5 | No fix listed |
| zendframework/zend-http(Packagist) | = 2.2.6 | No fix listed |
Show 97 more
| Product | Affected versions | Fixed in |
|---|---|---|
| zendframework/zend-http(Packagist) | = 2.2.7 | No fix listed |
| zendframework/zend-http(Packagist) | = 2.2.8 | No fix listed |
| zendframework/zend-http(Packagist) | = 2.2.9 | No fix listed |
| zendframework/zend-http(Packagist) | = 2.3.0 | No fix listed |
| zendframework/zend-http(Packagist) | = 2.3.1 | No fix listed |
| zendframework/zend-http(Packagist) | = 2.3.2 | No fix listed |
| zendframework/zend-http(Packagist) | = 2.3.3 | No fix listed |
| zendframework/zend-http(Packagist) | = 2.3.4 | No fix listed |
| zendframework/zend-http(Packagist) | = 2.3.5 | No fix listed |
| zendframework/zend-http(Packagist) | = 2.3.6 | No fix listed |
| zendframework/zend-http(Packagist) | = 2.3.7 | No fix listed |
| zendframework/zend-http(Packagist) | >= 2.4.0rc1, < 2.4.1 | 2.4.1 |
| zendframework/zend-http(Packagist) | = 2.4.0 | No fix listed |
| zendframework/zend-http(Packagist) | = 2.4.0rc1 | No fix listed |
| zendframework/zend-http(Packagist) | = 2.4.0rc2 | No fix listed |
| zendframework/zend-http(Packagist) | = 2.4.0rc3 | No fix listed |
| zendframework/zend-http(Packagist) | = 2.4.0rc4 | No fix listed |
| zendframework/zend-http(Packagist) | = 2.4.0rc5 | No fix listed |
| zendframework/zend-http(Packagist) | = 2.4.0rc6 | No fix listed |
| zendframework/zend-http(Packagist) | = 2.4.0rc7 | No fix listed |
| zendframework/zendframework(Packagist) | >= 2.0.0beta4, < 2.3.8 | 2.3.8 |
| zendframework/zendframework(Packagist) | = 2.0.0 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.0.0beta4 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.0.0beta5 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.0.0rc1 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.0.0rc2 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.0.0rc3 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.0.0rc4 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.0.0rc5 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.0.0rc6 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.0.0rc7 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.0.1 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.0.2 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.0.3 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.0.4 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.0.5 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.0.6 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.0.7 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.0.8 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.1.0 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.1.1 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.1.2 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.1.3 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.1.4 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.1.5 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.1.6 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.2.0 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.2.0rc1 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.2.0rc2 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.2.0rc3 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.2.1 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.2.10 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.2.2 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.2.3 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.2.4 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.2.5 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.2.6 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.2.7 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.2.8 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.2.9 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.3.0 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.3.1 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.3.2 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.3.3 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.3.4 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.3.5 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.3.6 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.3.7 | No fix listed |
| zendframework/zendframework(Packagist) | >= 2.4.0rc1, < 2.4.1 | 2.4.1 |
| zendframework/zendframework(Packagist) | = 2.4.0 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.4.0rc1 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.4.0rc2 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.4.0rc3 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.4.0rc4 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.4.0rc5 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.4.0rc6 | No fix listed |
| zendframework/zendframework(Packagist) | = 2.4.0rc7 | No fix listed |
| zendframework/zendframework1(Packagist) | < 1.12.12 | 1.12.12 |
| zendframework/zendframework1(Packagist) | = 1.12.0 | No fix listed |
| zendframework/zendframework1(Packagist) | = 1.12.1 | No fix listed |
| zendframework/zendframework1(Packagist) | = 1.12.10 | No fix listed |
| zendframework/zendframework1(Packagist) | = 1.12.11 | No fix listed |
| zendframework/zendframework1(Packagist) | = 1.12.2 | No fix listed |
| zendframework/zendframework1(Packagist) | = 1.12.3 | No fix listed |
| zendframework/zendframework1(Packagist) | = 1.12.4 | No fix listed |
| zendframework/zendframework1(Packagist) | = 1.12.5 | No fix listed |
| zendframework/zendframework1(Packagist) | = 1.12.6 | No fix listed |
| zendframework/zendframework1(Packagist) | = 1.12.7 | No fix listed |
| zendframework/zendframework1(Packagist) | = 1.12.8 | No fix listed |
| zendframework/zendframework1(Packagist) | = 1.12.9 | No fix listed |
| zendframework/zend-http(Packagist) | < 1.12.12 | 1.12.12 |
| zend framework | < 1.12.12 | 1.12.12 |
| zend framework | >= 2.3.0, < 2.3.8 | 2.3.8 |
| zend framework | >= 2.4.0, < 2.4.1 | 2.4.1 |
| Zend Technologies Zend Framework | = before 1.12.12 | No fix listed |
| Zend Technologies Zend Framework | = 2.x before 2.3.8 | No fix listed |
| Zend Technologies Zend Framework | = 2.4.x before 2.4.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- framework.zend.com
- github.com exploit
- github.com exploit
- github.com exploit
- github.com product
- github.com
- framework.zend.com exploit vendor-advisory