CVE-2015-1786: CSRF
Cross-site request forgery (CSRF) vulnerability in Zend/Validator/Csrf in Zend Framework 2.3.x before 2.3.6 via null or malformed token identifiers.
Other sources
Invalid CSRF validation of null or incorrectly formatted token identifiers
Zend\Validator\Csrf, starting in the Zend Framework 2.3 series, was not correctly identifying null or mal-formatted token identifiers, leading to false positive validations, and thus potentially allowing for Cross-Site Request Forgery vectors.
A patch was written that correctly identifies invalid token identifiers, ensuring that they invalidate the provided value. It was discovered that the vulnerability was introduced specifically in the 2.3 series, and thus no patch was necessary against the 2.2 series.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-1786?
CVE-2015-1786 is classified as a medium severity vulnerability due to its cross-site request forgery (CSRF) risk.
How do I fix CVE-2015-1786?
To fix CVE-2015-1786, upgrade Zend Framework to version 2.3.6 or later.
Which versions are affected by CVE-2015-1786?
CVE-2015-1786 affects Zend Framework versions from 2.3.0 to 2.3.5.
What type of vulnerability is CVE-2015-1786?
CVE-2015-1786 is a cross-site request forgery (CSRF) vulnerability.
What component of Zend Framework does CVE-2015-1786 impact?
CVE-2015-1786 impacts the Zend/Validator/Csrf component in Zend Framework.