-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| zendframework/zendframework | composer | >= 2.0.0, < 2.0.99 | 2.0.99 |
| zendframework/zendframework | composer | >= 2.1.0, < 2.1.99 | 2.1.99 |
| zendframework/zendframework | composer | >= 2.2.0, < 2.2.8 | 2.2.8 |
| zendframework/zendframework | composer | >= 2.3.0, < 2.3.3 | 2.3.3 |
| zendframework/zendframework1 | composer | >= 1.12.0, < 1.12.9 | 1.12.9 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper input sanitization in LDAP bind methods. The patch adds explicit null byte removal in Zend\Ldap\Ldap::bind (shown in the commit diff modifying Ldap.php) and corresponding test cases. Both ZF1's Zend_Ldap and ZF2's Zend\Ldap components were affected as they interface with PHP's vulnerable ldap_bind function without proper sanitization in affected versions. The direct code modification in the bind method to add str_replace('\0', '', $password) confirms this was the vulnerable entry point.