CVE-2023-0567

Katalog CVE

CVSS 6.2 · Medium EPSS 0,95%

Kerentanan Use of Password Hash With Insufficient Computational Effort pada php. Skor CVSS 3.1 6.2 (Medium) menurut NVD.

Deskripsi (NVD)

In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify() function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database, it may lead to an application allowing any password for this entry as valid.

Rincian

Terbit di NVD

1 Maret 2023

Terakhir diubah

19 Juli 2026

Status NVD

Modified

CVSS 3.1

6.2 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-916: Use of Password Hash With Insufficient Computational Effort

EPSS (30 hari)

0,95% peluang dieksploitasi; lebih tinggi dari 60,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugs.php.net/bug.php?id=81744 advisory vendor
• https://github.com/php/php-src/security/advisories/GHSA-7fj2-8x79-rjf4 exploit · advisory vendor
• https://security.netapp.com/advisory/ntap-20230331-0008/