PT-2004-2307 · Php+2 · Php+2
Frame
·
Published
2004-12-31
·
Updated
2017-10-11
·
CVE-2004-1392
CVSS v2.0
5.0
Medium
| Vector | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions:
PHP version 4.0
Description:
The issue allows remote attackers to bypass the open basedir setting, potentially leading to a loss of confidentiality. This is triggered when cURL functions fail to comply with the open basedir directive, which is designed to restrict PHP scripts. Attackers may be able to read arbitrary files via a file: URL argument to the
curl init() function.Recommendations:
For PHP version 4.0, consider disabling the
curl init() function until a patch is available to prevent bypassing the open basedir setting. Restrict access to sensitive files and directories to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Php
Red Hat
Curl