CVE-2023-37260

Katalog CVE

CVSS 7.5 · High EPSS 0,95%

Kerentanan Generation of Error Message Containing Sensitive Information pada thephpleague oauth2-server. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

league/oauth2-server is an implementation of an OAuth 2.0 authorization server written in PHP. Starting in version 8.3.2 and prior to version 8.5.3, servers that passed their keys to the CryptKey constructor as as string instead of a file path will have had that key included in a LogicException message if they did not provide a valid pass phrase for the key where required. This issue has been patched so that the provided key is no longer exposed in the exception message in the scenario outlined above. Users should upgrade to version 8.5.3 to receive the patch. As a workaround, pass the key as a file instead of a string.

Rincian

Terbit di NVD

6 Juli 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-209: Generation of Error Message Containing Sensitive Information

EPSS (30 hari)

0,95% peluang dieksploitasi; lebih tinggi dari 60,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/thephpleague/oauth2-server/security/advisories/GHSA-wj7q-gjg8-3cpm advisory vendor
• https://github.com/thephpleague/oauth2-server/pull/1353 patch
• https://github.com/thephpleague/oauth2-server/releases/tag/8.5.3 release notes