Doctrine/Doctrine-module Zero-Valued Authentication Credentials Vulnerability
Summary
GHSA-9wv8-3h8h-x2wc: doctrine/doctrine-module zero-valued authentication credentials vulnerability. Affects doctrine/doctrine-module versions < 0.7.2. Fixed in 0.7.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Doctrine/Doctrine-module is a package available on Packagist that provides integration between Doctrine ORM and Zend Framework. It allows developers to easily work with database entities and perform database operations. The package is widely used in PHP applications that utilize Zend Framework and Doctrine ORM. However, a vulnerability has been discovered in the package that allows an attacker to obtain a valid Zend\Authentication identity without knowing the user's credentials.
Vulnerability Detail
The vulnerability exists in the ObjectRepository authentication adapter of DoctrineModule. Under certain circumstances, it is possible to obtain a valid Zend\Authentication identity by using a numerically valued credential. This means that an attacker can bypass the authentication process and gain unauthorized access to the application. The vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
How To Fix
Minimum fixed version
0.7.2
This is the first release that contains the fix.
composer require doctrine/doctrine-module:0.7.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the package to the latest version as soon as possible.
Conclusion
The Doctrine/Doctrine-module package is vulnerable to a zero-valued authentication credentials vulnerability. This allows an attacker to bypass the authentication process and gain unauthorized access to the application. To fix this vulnerability, it is recommended to update the package to version 0.7.2 or higher. There are no known workarounds for this vulnerability. For further support, please contact DevNack.com.
See every vulnerability recorded for doctrine/doctrine-module →
FAQ
The vulnerability allows an attacker to bypass the authentication process and gain unauthorized access to the application. This can lead to unauthorized data access, privilege escalation, and potential data breaches.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your composer.lock file and Vulert will analyze it for any known vulnerabilities.
There are currently no known exploits for this vulnerability. However, it is important to update the package to the latest version to prevent any potential attacks.
You can find more information about this vulnerability, including the technical details and the fix, in the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-9wv8-3h8h-x2wc/GHSA-9wv8-3h8h-x2wc.json
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide guidance and assistance in fixing the vulnerability in your application.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
