Permissions, Privileges, and Access Controls in PHP - CVE-2013-1635

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU32704

Permissions, Privileges, and Access Controls in PHP - CVE-2013-1635

Published: March 6, 2013 / Updated: July 28, 2020


Vulnerability identifier: #VU32704
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2013-1635
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

ext/soap/soap.c in PHP before 5.3.22 and 5.4.x before 5.4.13 does not validate the relationship between the soap.wsdl_cache_dir directive and the open_basedir directive, which allows remote attackers to bypass intended access restrictions by triggering the creation of cached SOAP WSDL files in an arbitrary directory.


Affected software

PHP
Gentoo Linux
SUSE Linux
Slackware Linux
php (Alpine package)
dev-lang/php

How to mitigate CVE-2013-1635

Install update from vendor's website.

PHP - update to 5.3.22
php (Alpine package) - update to 5.3.23-r0
dev-lang/php - update to 5.5.16

External References

Related Security Bulletins