CVE-2015-5723: High severity zend cache vulnerability
Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before 1.0.2, and MongoDB ODM Bundle before 3.0.1 use world-writable permissions for cache directories, which allows local users to execute arbitrary PHP code with additional privileges by leveraging an application with the umask set to 0 and that executes cache entries as code.
Other sources
Filesystem Permissions Issues in Multiple Components
Security Misconfiguration Vulnerability in the AWS SDK for PHP
Security Misconfiguration Vulnerability in various Doctrine projects
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5723?
CVE-2015-5723 is classified as a moderate severity vulnerability due to the potential for local exploitation of world-writable permissions.
How do I fix CVE-2015-5723?
To fix CVE-2015-5723, update the affected packages to their patched versions listed in the vulnerability advisory.
Which versions are affected by CVE-2015-5723?
CVE-2015-5723 affects various versions of Doctrine Annotations, Cache, Common, ORM, MongoDB ODM, and several Zend Framework components.
What types of systems are impacted by CVE-2015-5723?
CVE-2015-5723 impacts systems using certain versions of Doctrine projects and Zend Framework components that utilize world-writable cache directories.
Is CVE-2015-5723 an easy vulnerability to exploit?
CVE-2015-5723 can be considered relatively easy to exploit for local users who have access to the system with misconfigured cache directory permissions.