Read the docs
TI-2014-02159 Aliases CVE-2014-2685GHSA-jh3g-pqch-xqxg

The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the…

Priority LOW 38CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-287.

Summary

The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Zend Framework 1 before 1.12.4 violate the OpenID 2.0 protocol by ensuring only that at least one field is signed, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider.

Why it matters now

EPSS 0.02802 86th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 97

CPEVersionsRoleVendor
cpe:2.3:a:zend:zend_framework:*:*:*:*:*:*:*:*up to 1.12.3VulnerableZend
cpe:2.3:a:zend:zend_framework:1.0.0:*:*:*:*:*:*:*1.0.0VulnerableZend
cpe:2.3:a:zend:zend_framework:1.0.0:rc1:*:*:*:*:*:*1.0.0 rc1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.0.0:rc2:*:*:*:*:*:*1.0.0 rc2VulnerableZend
cpe:2.3:a:zend:zend_framework:1.0.0:rc2a:*:*:*:*:*:*1.0.0 rc2aVulnerableZend
cpe:2.3:a:zend:zend_framework:1.0.0:rc3:*:*:*:*:*:*1.0.0 rc3VulnerableZend
cpe:2.3:a:zend:zend_framework:1.0.1:*:*:*:*:*:*:*1.0.1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.0.2:*:*:*:*:*:*:*1.0.2VulnerableZend
cpe:2.3:a:zend:zend_framework:1.0.3:*:*:*:*:*:*:*1.0.3VulnerableZend
cpe:2.3:a:zend:zend_framework:1.0.4:*:*:*:*:*:*:*1.0.4VulnerableZend
  • cpe:2.3:a:zend:zend_framework:*:*:*:*:*:*:*:* Versions up to 1.12.3 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.0.0:*:*:*:*:*:*:* Versions 1.0.0 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.0.0:rc1:*:*:*:*:*:* Versions 1.0.0 rc1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.0.0:rc2:*:*:*:*:*:* Versions 1.0.0 rc2 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.0.0:rc2a:*:*:*:*:*:* Versions 1.0.0 rc2a Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.0.0:rc3:*:*:*:*:*:* Versions 1.0.0 rc3 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.0.1:*:*:*:*:*:*:* Versions 1.0.1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.0.2:*:*:*:*:*:*:* Versions 1.0.2 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.0.3:*:*:*:*:*:*:* Versions 1.0.3 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.0.4:*:*:*:*:*:*:* Versions 1.0.4 Vulnerable ·Zend
Show 87 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:zend:zend_framework:1.5.0:*:*:*:*:*:*:*1.5.0VulnerableZend
cpe:2.3:a:zend:zend_framework:1.5.0:pl:*:*:*:*:*:*1.5.0 plVulnerableZend
cpe:2.3:a:zend:zend_framework:1.5.0:pr:*:*:*:*:*:*1.5.0 prVulnerableZend
cpe:2.3:a:zend:zend_framework:1.5.0:rc1:*:*:*:*:*:*1.5.0 rc1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.5.0:rc2:*:*:*:*:*:*1.5.0 rc2VulnerableZend
cpe:2.3:a:zend:zend_framework:1.5.0:rc3:*:*:*:*:*:*1.5.0 rc3VulnerableZend
cpe:2.3:a:zend:zend_framework:1.5.1:*:*:*:*:*:*:*1.5.1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.5.2:*:*:*:*:*:*:*1.5.2VulnerableZend
cpe:2.3:a:zend:zend_framework:1.5.3:*:*:*:*:*:*:*1.5.3VulnerableZend
cpe:2.3:a:zend:zend_framework:1.6.0:*:*:*:*:*:*:*1.6.0VulnerableZend
cpe:2.3:a:zend:zend_framework:1.6.0:rc1:*:*:*:*:*:*1.6.0 rc1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.6.0:rc2:*:*:*:*:*:*1.6.0 rc2VulnerableZend
cpe:2.3:a:zend:zend_framework:1.6.0:rc3:*:*:*:*:*:*1.6.0 rc3VulnerableZend
cpe:2.3:a:zend:zend_framework:1.6.1:*:*:*:*:*:*:*1.6.1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.6.2:*:*:*:*:*:*:*1.6.2VulnerableZend
cpe:2.3:a:zend:zend_framework:1.7.0:*:*:*:*:*:*:*1.7.0VulnerableZend
cpe:2.3:a:zend:zend_framework:1.7.0:pl1:*:*:*:*:*:*1.7.0 pl1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.7.0:pr:*:*:*:*:*:*1.7.0 prVulnerableZend
cpe:2.3:a:zend:zend_framework:1.7.1:*:*:*:*:*:*:*1.7.1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.7.2:*:*:*:*:*:*:*1.7.2VulnerableZend
cpe:2.3:a:zend:zend_framework:1.7.3:*:*:*:*:*:*:*1.7.3VulnerableZend
cpe:2.3:a:zend:zend_framework:1.7.3:pl1:*:*:*:*:*:*1.7.3 pl1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.7.4:*:*:*:*:*:*:*1.7.4VulnerableZend
cpe:2.3:a:zend:zend_framework:1.7.5:*:*:*:*:*:*:*1.7.5VulnerableZend
cpe:2.3:a:zend:zend_framework:1.7.6:*:*:*:*:*:*:*1.7.6VulnerableZend
cpe:2.3:a:zend:zend_framework:1.7.7:*:*:*:*:*:*:*1.7.7VulnerableZend
cpe:2.3:a:zend:zend_framework:1.7.8:*:*:*:*:*:*:*1.7.8VulnerableZend
cpe:2.3:a:zend:zend_framework:1.7.9:*:*:*:*:*:*:*1.7.9VulnerableZend
cpe:2.3:a:zend:zend_framework:1.8.0:*:*:*:*:*:*:*1.8.0VulnerableZend
cpe:2.3:a:zend:zend_framework:1.8.0:a1:*:*:*:*:*:*1.8.0 a1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.8.0:b1:*:*:*:*:*:*1.8.0 b1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.8.1:*:*:*:*:*:*:*1.8.1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.8.2:*:*:*:*:*:*:*1.8.2VulnerableZend
cpe:2.3:a:zend:zend_framework:1.8.3:*:*:*:*:*:*:*1.8.3VulnerableZend
cpe:2.3:a:zend:zend_framework:1.8.4:*:*:*:*:*:*:*1.8.4VulnerableZend
cpe:2.3:a:zend:zend_framework:1.8.4:pl1:*:*:*:*:*:*1.8.4 pl1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.8.5:*:*:*:*:*:*:*1.8.5VulnerableZend
cpe:2.3:a:zend:zend_framework:1.9.0:*:*:*:*:*:*:*1.9.0VulnerableZend
cpe:2.3:a:zend:zend_framework:1.9.0:a1:*:*:*:*:*:*1.9.0 a1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.9.0:b1:*:*:*:*:*:*1.9.0 b1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.9.0:rc1:*:*:*:*:*:*1.9.0 rc1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.9.1:*:*:*:*:*:*:*1.9.1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.9.2:*:*:*:*:*:*:*1.9.2VulnerableZend
cpe:2.3:a:zend:zend_framework:1.9.3:*:*:*:*:*:*:*1.9.3VulnerableZend
cpe:2.3:a:zend:zend_framework:1.9.3:pl1:*:*:*:*:*:*1.9.3 pl1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.9.4:*:*:*:*:*:*:*1.9.4VulnerableZend
cpe:2.3:a:zend:zend_framework:1.9.5:*:*:*:*:*:*:*1.9.5VulnerableZend
cpe:2.3:a:zend:zend_framework:1.9.6:*:*:*:*:*:*:*1.9.6VulnerableZend
cpe:2.3:a:zend:zend_framework:1.9.7:*:*:*:*:*:*:*1.9.7VulnerableZend
cpe:2.3:a:zend:zend_framework:1.9.8:*:*:*:*:*:*:*1.9.8VulnerableZend
cpe:2.3:a:zend:zend_framework:1.10.0:*:*:*:*:*:*:*1.10.0VulnerableZend
cpe:2.3:a:zend:zend_framework:1.10.0:alpha1:*:*:*:*:*:*1.10.0 alpha1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.10.0:beta1:*:*:*:*:*:*1.10.0 beta1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.10.0:rc1:*:*:*:*:*:*1.10.0 rc1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.10.1:*:*:*:*:*:*:*1.10.1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.10.2:*:*:*:*:*:*:*1.10.2VulnerableZend
cpe:2.3:a:zend:zend_framework:1.10.3:*:*:*:*:*:*:*1.10.3VulnerableZend
cpe:2.3:a:zend:zend_framework:1.10.4:*:*:*:*:*:*:*1.10.4VulnerableZend
cpe:2.3:a:zend:zend_framework:1.10.5:*:*:*:*:*:*:*1.10.5VulnerableZend
cpe:2.3:a:zend:zend_framework:1.10.6:*:*:*:*:*:*:*1.10.6VulnerableZend
cpe:2.3:a:zend:zend_framework:1.10.7:*:*:*:*:*:*:*1.10.7VulnerableZend
cpe:2.3:a:zend:zend_framework:1.10.8:*:*:*:*:*:*:*1.10.8VulnerableZend
cpe:2.3:a:zend:zend_framework:1.10.9:*:*:*:*:*:*:*1.10.9VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.0:*:*:*:*:*:*:*1.11.0VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.0:b1:*:*:*:*:*:*1.11.0 b1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.0:rc1:*:*:*:*:*:*1.11.0 rc1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.1:*:*:*:*:*:*:*1.11.1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.2:*:*:*:*:*:*:*1.11.2VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.3:*:*:*:*:*:*:*1.11.3VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.4:*:*:*:*:*:*:*1.11.4VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.5:*:*:*:*:*:*:*1.11.5VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.6:*:*:*:*:*:*:*1.11.6VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.7:*:*:*:*:*:*:*1.11.7VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.8:*:*:*:*:*:*:*1.11.8VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.9:*:*:*:*:*:*:*1.11.9VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.10:*:*:*:*:*:*:*1.11.10VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.11:*:*:*:*:*:*:*1.11.11VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.12:*:*:*:*:*:*:*1.11.12VulnerableZend
cpe:2.3:a:zend:zend_framework:1.11.13:*:*:*:*:*:*:*1.11.13VulnerableZend
cpe:2.3:a:zend:zend_framework:1.12.0:*:*:*:*:*:*:*1.12.0VulnerableZend
cpe:2.3:a:zend:zend_framework:1.12.0:rc1:*:*:*:*:*:*1.12.0 rc1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.12.0:rc2:*:*:*:*:*:*1.12.0 rc2VulnerableZend
cpe:2.3:a:zend:zend_framework:1.12.0:rc3:*:*:*:*:*:*1.12.0 rc3VulnerableZend
cpe:2.3:a:zend:zend_framework:1.12.0:rc4:*:*:*:*:*:*1.12.0 rc4VulnerableZend
cpe:2.3:a:zend:zend_framework:1.12.1:*:*:*:*:*:*:*1.12.1VulnerableZend
cpe:2.3:a:zend:zend_framework:1.12.2:*:*:*:*:*:*:*1.12.2VulnerableZend
cpe:2.3:a:zend:zendopenid:*:*:*:*:*:*:*:*up to 2.0.1VulnerableZend
  • cpe:2.3:a:zend:zend_framework:1.5.0:*:*:*:*:*:*:* Versions 1.5.0 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.5.0:pl:*:*:*:*:*:* Versions 1.5.0 pl Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.5.0:pr:*:*:*:*:*:* Versions 1.5.0 pr Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.5.0:rc1:*:*:*:*:*:* Versions 1.5.0 rc1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.5.0:rc2:*:*:*:*:*:* Versions 1.5.0 rc2 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.5.0:rc3:*:*:*:*:*:* Versions 1.5.0 rc3 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.5.1:*:*:*:*:*:*:* Versions 1.5.1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.5.2:*:*:*:*:*:*:* Versions 1.5.2 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.5.3:*:*:*:*:*:*:* Versions 1.5.3 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.6.0:*:*:*:*:*:*:* Versions 1.6.0 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.6.0:rc1:*:*:*:*:*:* Versions 1.6.0 rc1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.6.0:rc2:*:*:*:*:*:* Versions 1.6.0 rc2 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.6.0:rc3:*:*:*:*:*:* Versions 1.6.0 rc3 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.6.1:*:*:*:*:*:*:* Versions 1.6.1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.6.2:*:*:*:*:*:*:* Versions 1.6.2 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.7.0:*:*:*:*:*:*:* Versions 1.7.0 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.7.0:pl1:*:*:*:*:*:* Versions 1.7.0 pl1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.7.0:pr:*:*:*:*:*:* Versions 1.7.0 pr Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.7.1:*:*:*:*:*:*:* Versions 1.7.1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.7.2:*:*:*:*:*:*:* Versions 1.7.2 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.7.3:*:*:*:*:*:*:* Versions 1.7.3 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.7.3:pl1:*:*:*:*:*:* Versions 1.7.3 pl1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.7.4:*:*:*:*:*:*:* Versions 1.7.4 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.7.5:*:*:*:*:*:*:* Versions 1.7.5 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.7.6:*:*:*:*:*:*:* Versions 1.7.6 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.7.7:*:*:*:*:*:*:* Versions 1.7.7 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.7.8:*:*:*:*:*:*:* Versions 1.7.8 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.7.9:*:*:*:*:*:*:* Versions 1.7.9 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.8.0:*:*:*:*:*:*:* Versions 1.8.0 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.8.0:a1:*:*:*:*:*:* Versions 1.8.0 a1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.8.0:b1:*:*:*:*:*:* Versions 1.8.0 b1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.8.1:*:*:*:*:*:*:* Versions 1.8.1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.8.2:*:*:*:*:*:*:* Versions 1.8.2 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.8.3:*:*:*:*:*:*:* Versions 1.8.3 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.8.4:*:*:*:*:*:*:* Versions 1.8.4 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.8.4:pl1:*:*:*:*:*:* Versions 1.8.4 pl1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.8.5:*:*:*:*:*:*:* Versions 1.8.5 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.9.0:*:*:*:*:*:*:* Versions 1.9.0 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.9.0:a1:*:*:*:*:*:* Versions 1.9.0 a1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.9.0:b1:*:*:*:*:*:* Versions 1.9.0 b1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.9.0:rc1:*:*:*:*:*:* Versions 1.9.0 rc1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.9.1:*:*:*:*:*:*:* Versions 1.9.1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.9.2:*:*:*:*:*:*:* Versions 1.9.2 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.9.3:*:*:*:*:*:*:* Versions 1.9.3 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.9.3:pl1:*:*:*:*:*:* Versions 1.9.3 pl1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.9.4:*:*:*:*:*:*:* Versions 1.9.4 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.9.5:*:*:*:*:*:*:* Versions 1.9.5 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.9.6:*:*:*:*:*:*:* Versions 1.9.6 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.9.7:*:*:*:*:*:*:* Versions 1.9.7 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.9.8:*:*:*:*:*:*:* Versions 1.9.8 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.10.0:*:*:*:*:*:*:* Versions 1.10.0 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.10.0:alpha1:*:*:*:*:*:* Versions 1.10.0 alpha1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.10.0:beta1:*:*:*:*:*:* Versions 1.10.0 beta1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.10.0:rc1:*:*:*:*:*:* Versions 1.10.0 rc1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.10.1:*:*:*:*:*:*:* Versions 1.10.1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.10.2:*:*:*:*:*:*:* Versions 1.10.2 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.10.3:*:*:*:*:*:*:* Versions 1.10.3 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.10.4:*:*:*:*:*:*:* Versions 1.10.4 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.10.5:*:*:*:*:*:*:* Versions 1.10.5 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.10.6:*:*:*:*:*:*:* Versions 1.10.6 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.10.7:*:*:*:*:*:*:* Versions 1.10.7 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.10.8:*:*:*:*:*:*:* Versions 1.10.8 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.10.9:*:*:*:*:*:*:* Versions 1.10.9 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.0:*:*:*:*:*:*:* Versions 1.11.0 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.0:b1:*:*:*:*:*:* Versions 1.11.0 b1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.0:rc1:*:*:*:*:*:* Versions 1.11.0 rc1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.1:*:*:*:*:*:*:* Versions 1.11.1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.2:*:*:*:*:*:*:* Versions 1.11.2 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.3:*:*:*:*:*:*:* Versions 1.11.3 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.4:*:*:*:*:*:*:* Versions 1.11.4 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.5:*:*:*:*:*:*:* Versions 1.11.5 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.6:*:*:*:*:*:*:* Versions 1.11.6 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.7:*:*:*:*:*:*:* Versions 1.11.7 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.8:*:*:*:*:*:*:* Versions 1.11.8 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.9:*:*:*:*:*:*:* Versions 1.11.9 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.10:*:*:*:*:*:*:* Versions 1.11.10 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.11:*:*:*:*:*:*:* Versions 1.11.11 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.12:*:*:*:*:*:*:* Versions 1.11.12 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.11.13:*:*:*:*:*:*:* Versions 1.11.13 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.12.0:*:*:*:*:*:*:* Versions 1.12.0 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.12.0:rc1:*:*:*:*:*:* Versions 1.12.0 rc1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.12.0:rc2:*:*:*:*:*:* Versions 1.12.0 rc2 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.12.0:rc3:*:*:*:*:*:* Versions 1.12.0 rc3 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.12.0:rc4:*:*:*:*:*:* Versions 1.12.0 rc4 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.12.1:*:*:*:*:*:*:* Versions 1.12.1 Vulnerable ·Zend
  • cpe:2.3:a:zend:zend_framework:1.12.2:*:*:*:*:*:*:* Versions 1.12.2 Vulnerable ·Zend
  • cpe:2.3:a:zend:zendopenid:*:*:*:*:*:*:*:* Versions up to 2.0.1 Vulnerable ·Zend

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2014-2685
  2. 2026-10-03 Alias added: GHSA-jh3g-pqch-xqxg

References

Advisory 3

Other 2

  • TI-2021-02150 Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a… CVSS 3.1CRITICAL 9.8
  • TI-2012-02894 Zend_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not… CVSS 3.1CRITICAL 9.1
  • TI-2016-08119 The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11… CVSS 3.0CRITICAL 9.8
  • TI-2020-17638 An issue found in Zend Framework v.3.1.3 and before allow a remote attacker to execute… CVSS 3.1CRITICAL 9.8
  • TI-2016-04204 The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before… CVSS 3.0CRITICAL 9.8
  • TI-2011-01711 SQL injection in zendframework;PHP zendframework CVSS 3.1CRITICAL 9.8
See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences