Arbitrary Code Execution Affecting doctrine/orm package, versions <2.4.8 >=2.5.0, <2.5.1
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PHP-DOCTRINEORM-70031
- published 31 Aug 2015
- disclosed 31 Aug 2015
- credit Ryan Lane
Introduced: 31 Aug 2015
CVE-2015-5723 Open this link in a new tabHow to fix?
Upgrade doctrine/orm to version 2.5.1, 2.4.8 or higher.
Overview
Affected versions of doctrine/orm are vulnerable to Arbitrary Code Execution.
Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before 1.0.2, and MongoDB ODM Bundle before 3.0.1 use world-writable permissions for cache directories, which allows local users to execute arbitrary PHP code with additional privileges by leveraging an application with the umask set to 0 and that executes cache entries as code.