CVE-2004-1392: Medium severity PHP PHP vulnerability
Published Dec 31, 2004
·Updated
PHP 4.0 with cURL functions allows remote attackers to bypass the openbasedir setting and read arbitrary files via a file: URL argument to the curlinit function.
Affected Software
14 affected components
PHP PHP=4.0.4
PHP PHP=4.0.5
PHP PHP=4.0.7-rc2
PHP PHP=4.0.7-rc1
PHP PHP=4.0.3-patch1
PHP PHP=4.0.7
PHP PHP=4.0.2
PHP PHP=4.0.1-patch1
PHP PHP=4.0
PHP PHP=4.0.1-patch2
PHP PHP=4.0.6
PHP PHP=4.0.7-rc3
PHP PHP=4.0.1
PHP PHP=4.0.3
Remediation
Patch Available
Patch Available
Event History
Dec 31, 2004
CVE Published
05:00 AM
Feb 6, 2005
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2004-1392?
CVE-2004-1392 is considered a medium-level vulnerability due to the potential for unauthorized file access.
2
How do I fix CVE-2004-1392?
To fix CVE-2004-1392, upgrade to a secure version of PHP that does not allow bypassing the open_basedir restriction.
3
What versions of PHP are affected by CVE-2004-1392?
CVE-2004-1392 affects PHP versions 4.0.0 through 4.0.7-rc3.
4
Can CVE-2004-1392 be exploited without authentication?
Yes, CVE-2004-1392 can be exploited by remote attackers without requiring authentication.
5
What type of attack does CVE-2004-1392 facilitate?
CVE-2004-1392 facilitates file disclosure attacks, allowing attackers to read arbitrary files on the server.