Zend Framework 'Zend_View::render()' Directory Traversal Vulnerability
BID:35393
Info
Zend Framework 'Zend_View::render()' Directory Traversal Vulnerability
| Bugtraq ID: | 35393 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 17 2009 12:00AM |
| Updated: | Jun 22 2009 04:39PM |
| Credit: | Matthew Weier O'Phinney |
| Vulnerable: |
Zend Zend Framework 1.7 Red Hat Fedora 10 |
| Not Vulnerable: |
Zend Zend Framework 1.7.5 |
Discussion
Zend Framework 'Zend_View::render()' Directory Traversal Vulnerability
Zend Framework is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data.
Exploiting the issue may allow an attacker to obtain sensitive information that could aid in further attacks.
The issue affects versions prior to Zend Framework 1.7.5.
Zend Framework is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data.
Exploiting the issue may allow an attacker to obtain sensitive information that could aid in further attacks.
The issue affects versions prior to Zend Framework 1.7.5.
Exploit / POC
Zend Framework 'Zend_View::render()' Directory Traversal Vulnerability
An attacker can exploit this issue via a browser.
An attacker can exploit this issue via a browser.
Solution / Fix
Zend Framework 'Zend_View::render()' Directory Traversal Vulnerability
Solution:
The vendor has released fixes. Please see the references for details.
Solution:
The vendor has released fixes. Please see the references for details.
References
Zend Framework 'Zend_View::render()' Directory Traversal Vulnerability
References:
References: