CVEvulnerability

CVE-2023-0567

6.2 MEDIUM Published 2023-03-01 Modified 2026-07-19 Official page ↗
Status
Modified
Published
2023-03-01
Last modified
2026-07-19
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.7 HIGH — CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 3.1 ([email protected])
6.2 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
8.1 HIGH — CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-916

Description

In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify() function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database, it may lead to an application allowing any password for this entry as valid.

Affected configurations

• php php (>= 8.0.0 < 8.0.28) • php php (>= 8.1.0 < 8.1.16) • php php (>= 8.2.0 < 8.2.3)

Related

Weakness · CWE (1)

  • CWE-916 Use of Password Hash With Insufficient Computational Effort weakness

References