CVE-2020-29312

CRITICAL

Zend Framework < 3.1.3 - Remote Code Execution via Unserialize Function

Title source: llm

Description

An issue found in Zend Framework v.3.1.3 and before allow a remote attacker to execute arbitrary code via the unserialize function. Note: This has been disputed by third parties as incomplete and incorrect. The framework does not have a version that surpasses 2.x.x and was deprecated in early 2020.

References (3)

Core 3

Core References

Product

http://zend.com

Broken Link

https://cowtransfer.com/s/f9684f004d7149

Product

https://github.com/zendframework/zendframework

Scores

CVSS v3 9.8

EPSS 0.0152

EPSS Percentile 71.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

CWE

CWE-502

Status published

Products (1)

zend/zend_framework < 3.1.3

Published Apr 04, 2023

Tracked Since Feb 18, 2026