{"id":"GHSA-mg7h-9qfx-4r83","aliases":[],"status":"published","title":"ZendFramework Potential Proxy Injection Vulnerabilities","description":"`Zend\\Session\\Validator\\RemoteAddr` and `Zend\\View\\Helper\\ServerUrl` were found to be improperly parsing HTTP headers for proxy information, which could potentially allow an attacker to spoof a proxied IP or host name.\n\nIn `Zend\\Session\\Validator\\RemoteAddr`, if the client is behind a proxy server, the detection of the proxy URL was incorrect, and could lead to invalid results on subsequent lookups.\n\nIn `Zend\\View\\Helper\\ServerUrl`, if the server lives behind a proxy, the helper would always generate a URL based on the proxy host, regardless of whether or not this was desired; additionally, it did not take into account the proxy port or protocol, if provided.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-74"],"published":"2024-06-07T20:46:14Z","modified":"2024-12-04T05:25:14Z","fixes":[{"ecosystem":"Packagist","package":"zendframework/zendframework","fixed_in":["2.0.5"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"zendframework/zendframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.5"}]}]},{"source":"osv","ecosystem":"Packagist","package":"zendframework/zendframework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.5"}]}],"versions":["2.0.0","2.0.1","2.0.2","2.0.3","2.0.4"]}],"references":[{"url":"https://github.com/zendframework/zendframework/commit/1040acaf70d297ec7214934d8ddc3e811d249b5c","tags":["web"]},{"url":"https://github.com/zendframework/zendframework/commit/ad8fdc3378710b7cfbe2a271dbb0e3256cffb599","tags":["web"]},{"url":"https://github.com/zendframework/zendframework/commit/ada1fab92f6d5c7ad96c5a63f3196d925e3f5887","tags":["web"]},{"url":"https://github.com/zendframework/zendframework/commit/b914ecdd4d17ab5b61f15ccdc02a6e9b255b15d8","tags":["web"]},{"url":"https://github.com/zendframework/zendframework/commit/c3819abbf2c9571069c893d27ae6170bda413925","tags":["web"]},{"url":"https://github.com/zendframework/zendframework/commit/cfaf5ea095c93f3e70343358a3a88c3924d7ed7d","tags":["web"]},{"url":"https://framework.zend.com/security/advisory/ZF2012-04","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/ZF2012-04.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-mg7h-9qfx-4r83"},{"url":"https://github.com/zendframework/zendframework","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-mg7h-9qfx-4r83","title":"ZendFramework Potential Proxy Injection Vulnerabilities","description":"`Zend\\Session\\Validator\\RemoteAddr` and `Zend\\View\\Helper\\ServerUrl` were found to be improperly parsing HTTP headers for proxy information, which could potentially allow an attacker to spoof a proxied IP or host name.\n\nIn `Zend\\Session\\Validator\\RemoteAddr`, if the client is behind a proxy server, the detection of the proxy URL was incorrect, and could lead to invalid results on subsequent lookups.\n\nIn `Zend\\View\\Helper\\ServerUrl`, if the server lives behind a proxy, the helper would always generate a URL based on the proxy host, regardless of whether or not this was desired; additionally, it did not take into account the proxy port or protocol, if provided.","status":"published","published":"2024-06-07T20:46:14Z","modified":"2024-06-07T20:46:16Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:37:53.703286Z"}],"osv":[{"id":"GHSA-mg7h-9qfx-4r83","title":"ZendFramework Potential Proxy Injection Vulnerabilities","description":"`Zend\\Session\\Validator\\RemoteAddr` and `Zend\\View\\Helper\\ServerUrl` were found to be improperly parsing HTTP headers for proxy information, which could potentially allow an attacker to spoof a proxied IP or host name.\n\nIn `Zend\\Session\\Validator\\RemoteAddr`, if the client is behind a proxy server, the detection of the proxy URL was incorrect, and could lead to invalid results on subsequent lookups.\n\nIn `Zend\\View\\Helper\\ServerUrl`, if the server lives behind a proxy, the helper would always generate a URL based on the proxy host, regardless of whether or not this was desired; additionally, it did not take into account the proxy port or protocol, if provided.","status":"published","published":"2024-06-07T20:46:14Z","modified":"2024-12-04T05:25:14.395411Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T15:46:51.811331Z"}]}}