The output_add_rewrite_var function in PHP before 5.2.5 rewrites local forms in which the ACTION attribute references a non-local URL, which allows remote attackers to obtain potentially sensitive information by reading the requests for this URL, as demonstrated by a rewritten form containing a local session ID.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade php-ldapUpgrade php-mysqlUpgrade php-imapUpgrade php-develUpgrade phpUpgrade php-pgsqlUpgrade php-odbc | Dec 1, 2016 | Nov 20, 2007 |
| Oracle_linux | — | Upgrade php-gdUpgrade php-ldapUpgrade php-xmlUpgrade php-imapUpgrade php-pdoUpgrade php-dbaUpgrade phpUpgrade php-cliUpgrade php-ncursesUpgrade php-soapUpgrade php-bcmathUpgrade php-develUpgrade php-snmpUpgrade php-xmlrpcUpgrade php-mysqlUpgrade php-mbstringUpgrade php-odbcUpgrade php-commonUpgrade php-pgsql | Oct 16, 2024 | Nov 20, 2007 |
| Php | — | Upgrade to PHP version 5.2.5 | Oct 1, 2012 | Nov 20, 2007 |
| Ubuntu | — | Upgrade php5-cgiUpgrade php5-curlUpgrade php5-cliUpgrade libapache2-mod-php5 | Nov 8, 2024 | Nov 20, 2007 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub