CVEvulnerability

CVE-2023-3247

4.3 MEDIUM Published 2023-07-22 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-07-22
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
2.6 LOW — CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
CVSS 3.1 ([email protected])
4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-252, CWE-330

Description

In PHP versions 8.0.* before 8.0.29, 8.1.* before 8.1.20, 8.2.* before 8.2.7 when using SOAP HTTP Digest Authentication, random value generator was not checked for failure, and was using narrower range of values than it should have. In case of random generator failure, it could lead to a disclosure of 31 bits of uninitialized memory from the client to the server, and it also made easier to a malicious server to guess the client's nonce. 

Affected configurations

• php php (>= 8.0.0 < 8.0.29) • php php (>= 8.1.0 < 8.1.20) • php php (>= 8.2.0 < 8.2.7)

Related

Weakness · CWE (2)

  • CWE-252 Unchecked Return Value weakness
  • CWE-330 Use of Insufficiently Random Values weakness

References