Vulnerability · Published Oct 22, 2024 · Assigned by Perforce
CVE-2024-9129Format String Injection in Zend Server
Critical 9.3
In plain English
A critical-severity security flaw in Zend Server from Zend. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).
Severity (CVSS 4.0)9.3Critical
Exploit odds (30 days)0.4%top 63.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
In versions of Zend Server 8.5 and prior to version 9.2 a format string injection was discovered. Reported by Dylan Marino
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Zend | Zend Server | 8.5 – before 9.1 |
Weakness: CWE-134 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N