CVE-2007-3205

2007-06-1310:30:00

[email protected]

web.nvd.nist.gov

374

cve

2007

3205

php

hardened-php

suhosin

remote attack

variable overwriting

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

6.7 Medium

AI Score

Confidence

Low

0.065 Low

EPSS

Percentile

93.8%

JSON

The parse_str function in (1) PHP, (2) Hardened-PHP, and (3) Suhosin, when called without a second parameter, might allow remote attackers to overwrite arbitrary variables by specifying variable names and values in the string to be parsed. NOTE: it is not clear whether this is a design limitation of the function or a bug in PHP, although it is likely to be regarded as a bug in Hardened-PHP and Suhosin.

Affected configurations

NVD

Node

hardened-php_projecthardened-php

hardened-php_projectsubhosin

phpphp

CPENameOperatorVersion
hardened-php_project:hardened-phphardened-php project hardened-phpeq*
hardened-php_project:subhosinhardened-php project subhosineq*
php:phpphpeq*