CVE-2015-5723:
Doctrine Security Misconfiguration Vulnerability
7.8
CVSS ScoreBasic Information
CVE ID
GHSA ID
EPSS Score
-
CWE
-
Published
5/17/2022
Updated
2/5/2024
KEV Status
No
Technology
PHP
PHPTechnical Details
CVSS Vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| doctrine/annotations | composer | < 1.2.7 | 1.2.7 |
| doctrine/cache | composer | >= 1.4.0, < 1.4.2 | 1.4.2 |
| doctrine/common | composer | < 2.4.3 | 2.4.3 |
| doctrine/common | composer | >= 2.5.0-stable, < 2.5.1 | 2.5.1 |
| doctrine/orm | composer | >= 2.5.0, < 2.5.1 | 2.5.1 |
| doctrine/mongodb-odm | composer | < 1.0.2 | 1.0.2 |
| doctrine/mongodb-odm-bundle | composer | < 3.0.1 | 3.0.1 |
| zendframework/zendframework1 | composer | >= 1.12.0, < 1.12.16 | 1.12.16 |
| zendframework/zend-cache | composer | >= 2.5.0, < 2.5.3 | 2.5.3 |
| aws/aws-sdk-php | composer | >= 3.0.0, < 3.2.1 | 3.2.1 |
| doctrine/cache | composer | >= 1.0.0, < 1.3.2 | 1.3.2 |
| zendframework/zend-cache | composer | >= 2.4.0, < 2.4.8 | 2.4.8 |
| zendframework/zendframework | composer | >= 2.4.0, < 2.4.8 | 2.4.8 |
| zfcampus/zf-apigility-doctrine | composer | >= 1.0.0, < 1.0.3 | 1.0.3 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from directory creation with 0777 permissions when umask=0. Key functions were identified through:
- Doctrine's advisory explicitly mentioning cache directory permission fixes
- Zend Framework's security notice about Filesystem adapter changes
- Common patterns of cache initialization in ORM/ODM components
- File operations using PHP's mkdir() with insecure defaults These functions appear in stack traces when creating cache directories/files during normal operation, which would be exploited through permission-based code injection.