CVE-2015-3154

CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email.

Score

CVSS 3.1 6.1 Medium

Status

Modified - secalert@redhat.com

Published

2020-01-27

Last modified

2024-08-06

Weaknesses

CWE-74

Affected products

• Zend Framework (Zend)
• Zend Framework (Zend Technologies)

References

• http://framework.zend.com/security/advisory/ZF2015-04