CVE-2021-3007
highPriorität · beachten · 75EPSS 0.753 · 100. PerzentilExploit · PoCEUUSEPSS · bewertet 2026-10-27
Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the __destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: Zend Framework is no longer supported by the maintainer. NOTE: the laminas-http vendor considers this a "vulnerability in the PHP language itself" but has added certain type checking as a way to prevent exploitation in (unrecommended) use cases where attacker-supplied data can be deserialized
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · high–critical · 7.5–9.8
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
Exploits (3)
Öffentlicher Proof-of-Concept- und Exploit-Code.
- Vulnmachines/ZF3_CVE-2021-3007ZendFramework_CVE-2021-3007 PoCPoC · poc_in_github
- yunus-a1i/CVE-2021-3007-docker-pocyunus-a1i/CVE-2021-3007-docker-pocPoC · poc_in_github
betroffene Produkte (5)
Betroffene Produkte und Versionsbereiche.
Advisories (1)
Hersteller- und Ökosystem-Meldungen dazu.
- GHSA-xx8f-qf9f-5fgwRemote code execution in zendframework and laminas-http2021-06-08ghsa · osvUS
Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the __destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: Zend Framework is no longer supported by the maintainer. NOTE: the laminas-http vendor considers this a "vulnerability in the PHP language itself" but has added certain type checking as a way to prevent exploitation in (unrecommended) use cases where attacker-supplied data can be deserialized.
auch bekannt als (3)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (18)
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/Ling-Yizhou/zendframework3-/blob/main/zend%20framework3%20%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%20rce.mdcnnvd
- https://github.com/laminas/laminas-cnnvd
- https://github.com/laminas/laminas-http/commits/2.15.x/src/Response/Stream.phpPatchcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2021-3007cnnvd
- https://research.checkpoint.com/2021/freakout-leveraging-newest-vulnerabilities-for-creating-a-botnet/cnnvd
- https://vigilance.fr/vulnerability/Zend-Framework-code-execution-via-Zend-Http-Response-Stream-Deserialization-34232cnnvd
- https://www.cybersecurity-help.cz/vdb/SB2021042118cnnvd
- https://www.huawei.com/cn/psirt/security-notices/huawei-sn-20210120-01-liferay-cncnnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan