CVE-2022-25481: High severity thinkphp vulnerability
Published Mar 20, 2022
·Updated
ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter. This allows attackers to access all system environment parameters from index.php.
Affected Software
2 affected components
composer/topthink/framework<=5.0.24
ThinkPHP ThinkPHP=5.0.24
Event History
Mar 20, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Mar 21, 2022
Data Sourced
via NVD·12:15 AM
DescriptionSeverityWeaknessAffected Software
Mar 22, 2022
Advisory Published
via GitHub·12:00 AM
Frequently Asked Questions
1
What is the vulnerability ID?
The vulnerability ID is CVE-2022-25481.
2
What is the severity of CVE-2022-25481?
The severity of CVE-2022-25481 is high with a score of 7.5.
3
What is the affected software of CVE-2022-25481?
The affected software of CVE-2022-25481 is ThinkPHP Framework version 5.0.24.
4
How can attackers exploit CVE-2022-25481?
Attackers can exploit CVE-2022-25481 by accessing all system environment parameters from index.php due to the misconfiguration of ThinkPHP Framework.
5
Is there a fix for CVE-2022-25481?
A fix for CVE-2022-25481 is not currently available, but you can refer to the provided reference for more information.