{"id":"CVE-2015-5723","aliases":["GHSA-pw5c-xqf2-6xc2"],"url":"https://o3.security/vulnerability/CVE-2015-5723","summary":"Doctrine Security Misconfiguration Vulnerability","details":"Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before 1.0.2, and MongoDB ODM Bundle before 3.0.1 use world-writable permissions for cache directories, which allows local users to execute arbitrary PHP code with additional privileges by leveraging an application with the umask set to 0 and that executes cache entries as code.","published":"2016-06-07T14:06:08Z","modified":"2026-04-16T06:23:58.008730385Z","cvss":{"score":7.8,"severity":"HIGH","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"epss":{"score":0.00393,"percentile":0.32226,"asOf":"2026-08-29"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"doctrine/annotations","fixedVersion":"1.2.7"},{"ecosystem":"Packagist","name":"doctrine/cache","fixedVersion":"1.4.2"},{"ecosystem":"Packagist","name":"doctrine/common","fixedVersion":"2.4.3"},{"ecosystem":"Packagist","name":"doctrine/common","fixedVersion":"2.5.1"},{"ecosystem":"Packagist","name":"doctrine/orm","fixedVersion":"2.5.1"},{"ecosystem":"Packagist","name":"doctrine/mongodb-odm","fixedVersion":"1.0.2"},{"ecosystem":"Packagist","name":"doctrine/mongodb-odm-bundle","fixedVersion":"3.0.1"},{"ecosystem":"Packagist","name":"zendframework/zendframework1","fixedVersion":"1.12.16"},{"ecosystem":"Packagist","name":"zendframework/zend-cache","fixedVersion":"2.5.3"},{"ecosystem":"Packagist","name":"aws/aws-sdk-php","fixedVersion":"3.2.1"},{"ecosystem":"Packagist","name":"doctrine/cache","fixedVersion":"1.3.2"},{"ecosystem":"Packagist","name":"zendframework/zend-cache","fixedVersion":"2.4.8"},{"ecosystem":"Packagist","name":"zendframework/zendframework","fixedVersion":"2.4.8"},{"ecosystem":"Packagist","name":"zfcampus/zf-apigility-doctrine","fixedVersion":"1.0.3"}],"fix":null,"references":[{"type":"ADVISORY","url":"http://framework.zend.com/security/advisory/ZF2015-07"},{"type":"ADVISORY","url":"http://www.debian.org/security/2015/dsa-3369"},{"type":"ADVISORY","url":"http://www.doctrine-project.org/2015/08/31/security_misconfiguration_vulnerability_in_various_doctrine_projects.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2IUUC7HPN4XE5NNTG4MR76OC662XRZUO/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HPS7A54FQ2CR6PH4NDR6UIYJIRNFXW67/"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5723"},{"type":"WEB","url":"https://framework.zend.com/security/advisory/ZF2015-07"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/aws/aws-sdk-php/CVE-2015-5723.yaml"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/doctrine/cache/CVE-2015-5723.yaml"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/doctrine/orm/CVE-2015-5723.yaml"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zend-cache/CVE-2015-5723.yaml"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/CVE-2015-5723.yaml"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/CVE-2015-5723.yaml"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/zfcampus/zf-apigility-doctrine/CVE-2015-5723.yaml"},{"type":"WEB","url":"https://github.com/aws/aws-sdk-php/releases/tag/3.2.1"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2IUUC7HPN4XE5NNTG4MR76OC662XRZUO"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HPS7A54FQ2CR6PH4NDR6UIYJIRNFXW67"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2IUUC7HPN4XE5NNTG4MR76OC662XRZUO"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HPS7A54FQ2CR6PH4NDR6UIYJIRNFXW67"},{"type":"WEB","url":"https://www.doctrine-project.org/2015/08/31/security_misconfiguration_vulnerability_in_various_doctrine_projects.html"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-04-16T06:23:58.008730385Z"}}