CVE-2024-34467

2024-05-0420:15:07

[email protected]

web.nvd.nist.gov

thinkphp

vulnerability

phpsession

exposure

debug error

uri

get request

7.4 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

8.7%

JSON

ThinkPHP 8.0.3 allows remote attackers to discover the PHPSESSION cookie because think_exception.tpl (aka the debug error output source code) provides this in an error message for a crafted URI in a GET request.

References

github.com/top-think/framework/issues/2996