# CVE-2015-5723: Doctrine Security Misconfiguration Vulnerability

Source: https://junglewise.ai/threats/cve-2015-5723-doctrine-security-misconfiguration-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-05-17  
License: CC BY 4.0 with a link back

CVE-2015-5723 · Severity: low · CVSS 3 · Published 2022-05-17

Doctrine Security Misconfiguration Vulnerability

Technologies: [aws/aws-sdk-php (Packagist)](https://junglewise.ai/threats/technologies/aws-aws-sdk-php), [doctrine/orm (Packagist)](https://junglewise.ai/threats/technologies/doctrine-orm), [zendframework/zendframework (Packagist)](https://junglewise.ai/threats/technologies/zendframework-zendframework), [zendframework/zendframework1 (Packagist)](https://junglewise.ai/threats/technologies/zendframework-zendframework1). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2015-5723 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2015-5723 being exploited in the wild.

**How severe is CVE-2015-5723?** Low severity, with a CVSS score of 3, published 17 May 2022.

**Which products and versions are affected?** aws/aws-sdk-php (Packagist) ECOSYSTEM:introduced=3.0.0,fixed=3.2.1; doctrine/annotations (Packagist) ECOSYSTEM:introduced=0,fixed=1.2.7; doctrine/cache (Packagist) ECOSYSTEM:introduced=1.4.0,fixed=1.4.2; doctrine/common (Packagist) ECOSYSTEM:introduced=0,fixed=2.4.3; and 7 more.

**Is there a fix for CVE-2015-5723?** Yes. aws/aws-sdk-php (Packagist): upgrade to 3.2.1 or later; doctrine/annotations (Packagist): upgrade to 1.2.7 or later; doctrine/cache (Packagist): upgrade to 1.4.2 or later; doctrine/common (Packagist): upgrade to 2.4.3 or later; doctrine/mongodb-odm (Packagist): upgrade to 1.0.2 or later; doctrine/mongodb-odm-bundle (Packagist): upgrade to 3.0.1 or later; doctrine/orm (Packagist): upgrade to 2.5.1 or later; zendframework/zend-cache (Packagist): upgrade to 2.5.3 or later; zendframework/zendframework (Packagist): upgrade to 2.4.8 or later; zendframework/zendframework1 (Packagist): upgrade to 1.12.16 or later; zfcampus/zf-apigility-doctrine (Packagist): upgrade to 1.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2015-5723?** Check whether you run aws/aws-sdk-php (Packagist), doctrine/annotations (Packagist), doctrine/cache (Packagist) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- aws/aws-sdk-php (Packagist): upgrade to 3.2.1 or later

  ```sh
  composer require aws/aws-sdk-php:^3.2.1
  ```

- doctrine/annotations (Packagist): upgrade to 1.2.7 or later

  ```sh
  composer require doctrine/annotations:^1.2.7
  ```

- doctrine/cache (Packagist): upgrade to 1.4.2 or later

  ```sh
  composer require doctrine/cache:^1.4.2
  ```

- doctrine/common (Packagist): upgrade to 2.4.3 or later

  ```sh
  composer require doctrine/common:^2.4.3
  ```

- doctrine/mongodb-odm (Packagist): upgrade to 1.0.2 or later

  ```sh
  composer require doctrine/mongodb-odm:^1.0.2
  ```

- doctrine/mongodb-odm-bundle (Packagist): upgrade to 3.0.1 or later

  ```sh
  composer require doctrine/mongodb-odm-bundle:^3.0.1
  ```

- doctrine/orm (Packagist): upgrade to 2.5.1 or later

  ```sh
  composer require doctrine/orm:^2.5.1
  ```

- zendframework/zend-cache (Packagist): upgrade to 2.5.3 or later

  ```sh
  composer require zendframework/zend-cache:^2.5.3
  ```

- zendframework/zendframework (Packagist): upgrade to 2.4.8 or later

  ```sh
  composer require zendframework/zendframework:^2.4.8
  ```

- zendframework/zendframework1 (Packagist): upgrade to 1.12.16 or later

  ```sh
  composer require zendframework/zendframework1:^1.12.16
  ```

- zfcampus/zf-apigility-doctrine (Packagist): upgrade to 1.0.3 or later

  ```sh
  composer require zfcampus/zf-apigility-doctrine:^1.0.3
  ```


## Affected products

- aws/aws-sdk-php (Packagist) ECOSYSTEM:introduced=3.0.0,fixed=3.2.1
- doctrine/annotations (Packagist) ECOSYSTEM:introduced=0,fixed=1.2.7
- doctrine/cache (Packagist) ECOSYSTEM:introduced=1.4.0,fixed=1.4.2
- doctrine/common (Packagist) ECOSYSTEM:introduced=0,fixed=2.4.3
- doctrine/mongodb-odm (Packagist) ECOSYSTEM:introduced=0,fixed=1.0.2
- doctrine/mongodb-odm-bundle (Packagist) ECOSYSTEM:introduced=0,fixed=3.0.1
- doctrine/orm (Packagist) ECOSYSTEM:introduced=2.5.0,fixed=2.5.1
- zendframework/zend-cache (Packagist) ECOSYSTEM:introduced=2.5.0,fixed=2.5.3
- zendframework/zendframework (Packagist) ECOSYSTEM:introduced=2.4.0,fixed=2.4.8
- zendframework/zendframework1 (Packagist) ECOSYSTEM:introduced=1.12.0,fixed=1.12.16
- zfcampus/zf-apigility-doctrine (Packagist) ECOSYSTEM:introduced=1.0.0,fixed=1.0.3

## Identifiers

- CVE-2015-5723
- GHSA-pw5c-xqf2-6xc2

## Related threats

- [AWS SDK for PHP has CloudFront Policy Document Injection via Special Characters](https://junglewise.ai/threats/aws-sdk-for-php-has-cloudfront-policy-document-injection-via-special-575716bd)
- [AWS SDK for PHP's S3 Encryption Client has a Key Commitment Issue](https://junglewise.ai/threats/cve-2025-14761-aws-sdk-for-php-s-s3-encryption-client-has-a-key-commitment-issue)
- [Zendframework1 Potential SQL injection in ORDER and GROUP functions](https://junglewise.ai/threats/zendframework1-potential-sql-injection-in-order-and-group-functions-dd3023b3)
- [Zendframework Potential Information Disclosure and Insufficient Entropy vulnerability](https://junglewise.ai/threats/zendframework-potential-information-disclosure-and-insufficient-entropy-425eba68)
- [ZendFramework1 Potential Insufficient Entropy Vulnerability](https://junglewise.ai/threats/zendframework1-potential-insufficient-entropy-vulnerability-57e56245)