CVE-2022-25481

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-25481
ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter. This allows attackers to access all system environment parameters from index.php. NOTE: this is disputed by a third party because system environment exposure is an intended feature of the debugging mode.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
https://github.com/Lyther/VulnDiscover/blob/master/Web/ThinkPHP_InfoLeak.md Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:thinkphp:thinkphp:5.0.24:*:*:*:*:*:*:*
History

23 Apr 2024, 08:15

Type Values Removed Values Added
Summary (en) ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter. This allows attackers to access all system environment parameters from index.php. (en) ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter. This allows attackers to access all system environment parameters from index.php. NOTE: this is disputed by a third party because system environment exposure is an intended feature of the debugging mode.
Information

Published : 2022-03-21 00:15

Updated : 2024-06-04 19:17

NVD link : CVE-2022-25481

Mitre link : CVE-2022-25481

CVE.ORG link : CVE-2022-25481

JSON object : View

Products Affected

thinkphp

  • thinkphp
CWE
CWE-668

Exposure of Resource to Wrong Sphere