CVE-2022-25481 - ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter

Back Back to CVE browser

HIGH

ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter

Published Mar 20, 2022

7.5

HIGH

CVSS 3.1

EPSS 4.75%

Description

ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter. This allows attackers to access all system environment parameters from index.php. NOTE: this is disputed by a third party because system environment exposure is an intended feature of the debugging mode.

Affected products

Vendor Thinkphp Product Thinkphp Default
n/a

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Thinkphp

n/a

Version	Status	Constraints

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-284

CWE-668

References (3)

https://github.com/Lyther/VulnDiscover/blob/master/Web/ThinkPHP_InfoLeak.md
ExploitThird Party Advisory
https://github.com/advisories/GHSA-69wp-xwm7-69wm
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-25481

Link	Providers	Tags
https://github.com/Lyther/VulnDiscover/blob/master/Web/ThinkPHP_InfoLeak.md		ExploitThird Party Advisory
https://github.com/advisories/GHSA-69wp-xwm7-69wm		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-25481