Critical severity · published Oct 22, 2024
CVE-2024-9129
Format String Injection in Zend Server
9.3
CVSS
0.4%
EPSS
No
On KEV
Description
In versions of Zend Server 8.5 and prior to version 9.2 a format string injection was discovered.
Reported by Dylan Marino
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZS
Zend Server · Zend
8.5 before 9.1 · source: vendor, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-9129
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-9129
portal.perforce.com
https://portal.perforce.com/s/detail/a91PA000001SYZFYA4
More from Zend Server
6.1
CVE-2018-10230
Zend Debugger in Zend Server before 9.1.3 has XSS, aka ZSR-2455
–
CVE-2012-5382
Untrusted search path vulnerability in the installation functionality in Zend Server 5.6.0 SP4, when installed in the top-level C:\ directory, might allow local users to gain…