CVE-2020-29312

CRITICAL

Zend Framework <3.1.3 - RCE

Title source: llm

Description

An issue found in Zend Framework v.3.1.3 and before allow a remote attacker to execute arbitrary code via the unserialize function. Note: This has been disputed by third parties as incomplete and incorrect. The framework does not have a version that surpasses 2.x.x and was deprecated in early 2020.

References (3)

[Product] http://zend.com

[Broken Link] https://cowtransfer.com/s/f9684f004d7149

[Product] https://github.com/zendframework/zendframework

Scores

CVSS v3 9.8

EPSS 0.0250

EPSS Percentile 85.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

CWE

CWE-502

Status published

Affected Products (1)

zend/zend_framework < 3.1.3

Timeline

Published Apr 04, 2023

Tracked Since Feb 18, 2026