Read the docs
TI-2024-38951 Aliases GHSA-w5mj-j45q-m638

ZendFramework1 Potential Security Issues in Bundled Dojo Library

Priority LOW 38Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

In mid-March, 2010, the Dojo Foundation issued a Security Advisory indicating potential security issues with specific files in Dojo Toolkit. Details of the advisory may be found on the Dojo website: http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory/ In particular, several files in the Dojo tree were identified as having potential exploits, and the Dojo team also advised disabling or removing any PHP scripts in the tree when deploying to production.

Why it matters now

Fix Fixed zendframework/zendframework1 (Packagist): 1.9.8, 1.10.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—zendframework/zendframework1 (Packagist)1.9.0 to before 1.9.81.9.8Patch availableGHSA-w5mj-j45q-m638
—zendframework/zendframework1 (Packagist)1.10.0 to before 1.10.31.10.3Patch availableGHSA-w5mj-j45q-m638
  • zendframework/zendframework1 (Packagist) Vendor— Affected 1.9.0 to before 1.9.8 Fixed in 1.9.8 Patch available GHSA-w5mj-j45q-m638
  • zendframework/zendframework1 (Packagist) Vendor— Affected 1.10.0 to before 1.10.3 Fixed in 1.10.3 Patch available GHSA-w5mj-j45q-m638

Remediation

  • Fix · GHSA-w5mj-j45q-m638 zendframework/zendframework1 (Packagist) Fixed in 1.9.8 Advisory →
  • Fix · GHSA-w5mj-j45q-m638 zendframework/zendframework1 (Packagist) Fixed in 1.10.3 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-w5mj-j45q-m638

References

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences