CVE-2015-3154 Zenario CMS vulnerable to CRLF injection

What is CVE-2015-3154?

CVE-2015-3154 is a medium-severity vulnerability in Zend Framework, published on 27 Jan 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email.

Weakness: CWE-74

Which versions are affected by CVE-2015-3154?

12 open source packages ship an affected version, including zendframework/zend-http, zendframework/zendframework and zendframework/zendframework1. It affects 1 product.

Products include Zend Zend Framework.

How do I fix CVE-2015-3154?

Upgrade zendframework/zend-http to a fixed version for your release line: 1.12.12, 2.3.8 or 2.4.1.

Is CVE-2015-3154 being exploited?

There is no known exploitation of CVE-2015-3154 in the wild and no public exploit code.

Other vulnerabilities in Zend Framework

• CVE-2020-29312 Deserialization in n/a Critical 9.8
• CVE-2015-1555 Auth bypass in n/a Critical 9.1
• CVE-2015-1786 Zend Framework CSRF Vulnerability High 8.8
• CVE-2015-7503 Zend Framework Information Disclosure High 7.5
• CVE-2014-2685 Auth bypass in n/a High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CLSA-2026-1787214807, GHSA-5957-5crx-79jx, MGASA-2015-0241, UBUNTU-CVE-2015-3154.