VulnerabilityModified
CVE-2007-5900
PHP before 5.2.5 allows local users to bypass protection mechanisms configured through php_admin_value or php_admin_flag in httpd.conf by using ini_set to modify arbitrary configuration variables, a different issue than CVE-2006-4625.
MEDIUM 6.9EPSS 0.34%
Does this matter?
Lower severity and a low EPSS score (0.34%). Track it; it rarely justifies an emergency change on its own.
Description
PHP before 5.2.5 allows local users to bypass protection mechanisms configured through php_admin_value or php_admin_flag in httpd.conf by using ini_set to modify arbitrary configuration variables, a different issue than CVE-2006-4625.
- CVSS 2.0
- 6.9 MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 0.34% probability · 27th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- php/php
- Source
- cve@mitre.org
References
- http://bugs.php.net/bug.php?id=41561
- http://secunia.com/advisories/27648Patch, Vendor Advisory
- http://secunia.com/advisories/27659
- http://secunia.com/advisories/30040
- http://securitytracker.com/id?1018934
- http://wiki.rpath.com/wiki/Advisories:rPSA-2007-0242
- http://www.php.net/ChangeLog-5.php#5.2.5
- http://www.php.net/releases/5_2_5.php
- http://www.securityfocus.com/archive/1/491693/100/0/threaded
- https://issues.rpath.com/browse/RPL-1943
- http://bugs.php.net/bug.php?id=41561
- http://secunia.com/advisories/27648Patch, Vendor Advisory
- http://secunia.com/advisories/27659
- http://secunia.com/advisories/30040
- http://securitytracker.com/id?1018934
- http://wiki.rpath.com/wiki/Advisories:rPSA-2007-0242
- http://www.php.net/ChangeLog-5.php#5.2.5
- http://www.php.net/releases/5_2_5.php
- http://www.securityfocus.com/archive/1/491693/100/0/threaded
- https://issues.rpath.com/browse/RPL-1943
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.