Lucene search

K
cveMitreCVE-2011-0752
HistoryFeb 02, 2011 - 10:00 p.m.

CVE-2011-0752

2011-02-0222:00:01
CWE-20
mitre
web.nvd.nist.gov
84
cve-2011-0752
php
extract function
vulnerability
access restrictions
nvd

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

AI Score

9.3

Confidence

High

EPSS

0.014

Percentile

86.5%

The extract function in PHP before 5.2.15 does not prevent use of the EXTR_OVERWRITE parameter to overwrite (1) the GLOBALS superglobal array and (2) the this variable, which allows context-dependent attackers to bypass intended access restrictions by modifying data structures that were not intended to depend on external input, a related issue to CVE-2005-2691 and CVE-2006-3758.

Affected configurations

Nvd
Node
phpphpRange5.2.14
OR
phpphpMatch1.0
OR
phpphpMatch2.0
OR
phpphpMatch2.0b10
OR
phpphpMatch3.0
OR
phpphpMatch3.0.1
OR
phpphpMatch3.0.2
OR
phpphpMatch3.0.3
OR
phpphpMatch3.0.4
OR
phpphpMatch3.0.5
OR
phpphpMatch3.0.6
OR
phpphpMatch3.0.7
OR
phpphpMatch3.0.8
OR
phpphpMatch3.0.9
OR
phpphpMatch3.0.10
OR
phpphpMatch3.0.11
OR
phpphpMatch3.0.12
OR
phpphpMatch3.0.13
OR
phpphpMatch3.0.14
OR
phpphpMatch3.0.15
OR
phpphpMatch3.0.16
OR
phpphpMatch3.0.17
OR
phpphpMatch3.0.18
OR
phpphpMatch4.0beta_4_patch1
OR
phpphpMatch4.0beta1
OR
phpphpMatch4.0beta2
OR
phpphpMatch4.0beta3
OR
phpphpMatch4.0beta4
OR
phpphpMatch4.0.0
OR
phpphpMatch4.0.1
OR
phpphpMatch4.0.2
OR
phpphpMatch4.0.3
OR
phpphpMatch4.0.4
OR
phpphpMatch4.0.5
OR
phpphpMatch4.0.6
OR
phpphpMatch4.0.7
OR
phpphpMatch4.1.0
OR
phpphpMatch4.1.1
OR
phpphpMatch4.1.2
OR
phpphpMatch4.2.0
OR
phpphpMatch4.2.1
OR
phpphpMatch4.2.2
OR
phpphpMatch4.2.3
OR
phpphpMatch4.3.0
OR
phpphpMatch4.3.1
OR
phpphpMatch4.3.2
OR
phpphpMatch4.3.3
OR
phpphpMatch4.3.4
OR
phpphpMatch4.3.5
OR
phpphpMatch4.3.6
OR
phpphpMatch4.3.7
OR
phpphpMatch4.3.8
OR
phpphpMatch4.3.9
OR
phpphpMatch4.3.10
OR
phpphpMatch4.3.11
OR
phpphpMatch4.4.0
OR
phpphpMatch4.4.1
OR
phpphpMatch4.4.2
OR
phpphpMatch4.4.3
OR
phpphpMatch4.4.4
OR
phpphpMatch4.4.5
OR
phpphpMatch4.4.6
OR
phpphpMatch4.4.7
OR
phpphpMatch4.4.8
OR
phpphpMatch4.4.9
OR
phpphpMatch5.0.0
OR
phpphpMatch5.0.0beta1
OR
phpphpMatch5.0.0beta2
OR
phpphpMatch5.0.0beta3
OR
phpphpMatch5.0.0beta4
OR
phpphpMatch5.0.0rc1
OR
phpphpMatch5.0.0rc2
OR
phpphpMatch5.0.0rc3
OR
phpphpMatch5.0.1
OR
phpphpMatch5.0.2
OR
phpphpMatch5.0.3
OR
phpphpMatch5.0.4
OR
phpphpMatch5.0.5
OR
phpphpMatch5.1.0
OR
phpphpMatch5.1.1
OR
phpphpMatch5.1.2
OR
phpphpMatch5.1.3
OR
phpphpMatch5.1.4
OR
phpphpMatch5.1.5
OR
phpphpMatch5.1.6
OR
phpphpMatch5.2.0
OR
phpphpMatch5.2.1
OR
phpphpMatch5.2.2
OR
phpphpMatch5.2.3
OR
phpphpMatch5.2.4
OR
phpphpMatch5.2.5
OR
phpphpMatch5.2.6
OR
phpphpMatch5.2.7
OR
phpphpMatch5.2.8
OR
phpphpMatch5.2.9
OR
phpphpMatch5.2.10
OR
phpphpMatch5.2.11
OR
phpphpMatch5.2.12
OR
phpphpMatch5.2.13
VendorProductVersionCPE
phpphp*cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
phpphp1.0cpe:2.3:a:php:php:1.0:*:*:*:*:*:*:*
phpphp2.0cpe:2.3:a:php:php:2.0:*:*:*:*:*:*:*
phpphp2.0b10cpe:2.3:a:php:php:2.0b10:*:*:*:*:*:*:*
phpphp3.0cpe:2.3:a:php:php:3.0:*:*:*:*:*:*:*
phpphp3.0.1cpe:2.3:a:php:php:3.0.1:*:*:*:*:*:*:*
phpphp3.0.2cpe:2.3:a:php:php:3.0.2:*:*:*:*:*:*:*
phpphp3.0.3cpe:2.3:a:php:php:3.0.3:*:*:*:*:*:*:*
phpphp3.0.4cpe:2.3:a:php:php:3.0.4:*:*:*:*:*:*:*
phpphp3.0.5cpe:2.3:a:php:php:3.0.5:*:*:*:*:*:*:*
Rows per page:
1-10 of 991

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

AI Score

9.3

Confidence

High

EPSS

0.014

Percentile

86.5%