Log in Start free

Vulnerability · Published Jan 4, 2021 · Assigned by mitre

CVE-2021-3007

Critical 9.8

In plain English

A critical-severity security flaw in the laminas/laminas-http package (Packagist). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 75.3% (higher than 99.5% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)75.3%top 0.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling2Nuclei, Public PoC

Official description

Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the __destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: Zend Framework is no longer supported by the maintainer. NOTE: the laminas-http vendor considers this a "vulnerability in the PHP language itself" but has added certain type checking as a way to prevent exploitation in (unrecommended) use cases where attacker-supplied data can be deserialized

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistlaminas/laminas-http2.14.2GHSA-xx8f-qf9f-5fgw
Packagistzendframework/zendframeworkno fix listedGHSA-xx8f-qf9f-5fgw

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References