PT-2004-2307 · Php+2 · Php+2
Frame
·
Publicado
2004-12-31
·
Atualizado
2017-10-11
·
CVE-2004-1392
CVSS v2.0
5.0
Média
| Vetor | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions:
PHP version 4.0
Description:
The issue allows remote attackers to bypass the open basedir setting, potentially leading to a loss of confidentiality. This is triggered when cURL functions fail to comply with the open basedir directive, which is designed to restrict PHP scripts. Attackers may be able to read arbitrary files via a file: URL argument to the
curl init() function.Recommendations:
For PHP version 4.0, consider disabling the
curl init() function until a patch is available to prevent bypassing the open basedir setting. Restrict access to sensitive files and directories to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Php
Red Hat
Curl