CVEvulnerability

CVE-2014-4721

2.6 LOW Published 2014-07-06 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2014-07-06
Last modified
2026-06-17
Assigner
[email protected]
CVSS 2.0 ([email protected])
2.6 LOW — AV:N/AC:H/Au:N/C:P/I:N/A:N
Weaknesses
CWE-200

Description

The phpinfo implementation in ext/standard/info.c in PHP before 5.4.30 and 5.5.x before 5.5.14 does not ensure use of the string data type for the PHP_AUTH_PW, PHP_AUTH_TYPE, PHP_AUTH_USER, and PHP_SELF variables, which might allow context-dependent attackers to obtain sensitive information from process memory by using the integer data type with crafted values, related to a "type confusion" vulnerability, as demonstrated by reading a private SSL key in an Apache HTTP Server web-hosting environment with mod_ssl and a PHP 5.3.x mod_php.

Affected configurations

• php php (>= 5.3.0 < 5.3.29) • php php (>= 5.4.0 < 5.4.30) • php php (>= 5.5.0 < 5.5.14) • debian debian linux 7.0 • debian debian linux 8.0

Related

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References