NVD

Id
37808  
Name
CVE-2013-1635  
Description
ext/soap/soap.c in PHP before 5.3.22 and 5.4.x before 5.4.13 does not validate the relationship between the soap.wsdl_cache_dir directive and the open_basedir directive, which allows remote attackers to bypass intended access restrictions by triggering the creation of cached SOAP WSDL files in an arbitrary directory.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-18  
Published
2013-03-06  
Modified Date
2014-01-27  
Seq
2013-1635  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
192500 37808 CVE-2013-1635 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=702221  View
192501 37808 CVE-2013-1635 http://git.php.net/?p=php-src.git;a=blob;f=NEWS;h=36f6f9a4396d3034cc903a4271e7fdeccc5d3ea6;hb=refs/heads/PHP-5.4  View
192502 37808 CVE-2013-1635 http://git.php.net/?p=php-src.git;a=blob;f=NEWS;h=82afa3a040e639f3595121e45b850d5453906a00;hb=refs/heads/PHP-5.3  View
192503 37808 CVE-2013-1635 http://git.php.net/?p=php-src.git;a=commitdiff;h=702b436ef470cc02f8e2cc21f2fadeee42103c74  View
192504 37808 CVE-2013-1635 APPLE-SA-2013-09-12-1  View
192505 37808 CVE-2013-1635 SUSE-SU-2013:1285  View
192506 37808 CVE-2013-1635 SUSE-SU-2013:1315  View
192507 37808 CVE-2013-1635 http://support.apple.com/kb/HT5880  View
192508 37808 CVE-2013-1635 DSA-2639  View
192509 37808 CVE-2013-1635 MDVSA-2013:114  View
192510 37808 CVE-2013-1635 https://bugs.gentoo.org/show_bug.cgi?id=459904  View
192511 37808 CVE-2013-1635 https://bugzilla.redhat.com/show_bug.cgi?id=918196  View
192512 37808 CVE-2013-1635 https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0101  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
20184 JVNDB-2013-001759 PHP の ext/soap/soap.c におけるアクセス制限を回避される脆弱性 PHP の ext/soap/soap.c は、soap.wsdl_cache_dir ディレクティブと open_basedir ディレクティブとの関係を検証しないため、アクセス制限を回避される脆弱性が存在します。 CVE-2013-1635 61577 CVE-2013-1635 37808 7.5 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-001759.html 2013-02-21 2014-04-07 View