CVE-2015-7503

moderate-risk

Published 2017-10-10

Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remote attackers to recover the RSA private key.

Do I need to act?

0.25% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.5/10 High

NETWORK / LOW complexity

Affected Products (11)

Zend Framework

Affected Vendors

Zend

References (4)

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1283137

Vendor Advisory https://framework.zend.com/security/advisory/ZF2015-10

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1283137

Vendor Advisory https://framework.zend.com/security/advisory/ZF2015-10

/ 100

moderate-risk

Severity 26/34 · High

Exploitability 1/34 · Minimal

Exposure 16/34 · Moderate