CVE-2020-29312
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk66th percentile - higher than 66% of all known CVEs
Summary
An issue found in Zend Framework v.3.1.3 and before allows a remote attacker to execute arbitrary code via the unserialize function. However, this has been disputed by third parties as incomplete and incorrect, and the framework does not have a version that surpasses 2.x.x and was deprecated in early 2020.
Risk Assessment
The risk for the organization is the potential for remote code execution by an attacker, which could lead to system compromise, data theft, or application disruption. However, the vulnerability is disputed, meaning the actual risk may be lower or unconfirmed.
Recommendation
It is recommended to immediately update Zend Framework to the latest available version or migrate to an actively supported framework such as Laminas. Also, avoid deserializing untrusted data and use secure alternatives.
Original NVD description (English source)
An issue found in Zend Framework v.3.1.3 and before allow a remote attacker to execute arbitrary code via the unserialize function. Note: This has been disputed by third parties as incomplete and incorrect. The framework does not have a version that surpasses 2.x.x and was deprecated in early 2020.