The output_add_rewrite_var function in PHP before 5.2.5 rewrites local forms in which the ACTION attribute references a non-local URL, which allows remote attackers to obtain potentially sensitive information by reading the requests for this URL, as demonstrated by a rewritten form containing a local session ID.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade php-imapUpgrade php-develUpgrade php-ldapUpgrade phpUpgrade php-odbcUpgrade php-pgsqlUpgrade php-mysql | Dec 1, 2016 | Nov 20, 2007 |
| Oracle_linux | — | Upgrade php-pgsqlUpgrade php-mbstringUpgrade php-mysqlUpgrade php-xmlrpcUpgrade php-odbcUpgrade php-commonUpgrade php-ldapUpgrade php-gdUpgrade php-snmpUpgrade php-soapUpgrade php-xmlUpgrade php-develUpgrade php-pdoUpgrade phpUpgrade php-cliUpgrade php-ncursesUpgrade php-bcmathUpgrade php-imapUpgrade php-dba | Oct 16, 2024 | Nov 20, 2007 |
| Php | — | Upgrade to PHP version 5.2.5 | Oct 1, 2012 | Nov 20, 2007 |
| Ubuntu | — | Upgrade php5-cliUpgrade php5-cgiUpgrade php5-curlUpgrade libapache2-mod-php5 | Nov 8, 2024 | Nov 20, 2007 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub