Jerome Gamez Firebase Admin SDK for PHP Incorrect Access Control vulnerability

高 8.1CVE-2018-1000025 · GHSA-4gjj-r7w8-42cq · 09/02/2018 公開 · 17/06/2026 更新

要点

CVE-2018-1000025 は kreait/firebase-php, firebase admin sdk for php (firebase admin sdk for php project) に影響する深刻度「高」 (CVSS 8.1) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.3%（全脆弱性の 70.8% より高い）。
対処：3.8.1 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
kreait/firebase-php Packagist	`≥ 3.2.0, < 3.8.1`	`3.8.1`
firebase admin sdk for php firebase_admin_sdk_for_php_project	`≥ 3.2.0, ≤ 3.8.0`	修正版なし

概要

Jerome Gamez Firebase Admin SDK for PHP version from 3.2.0 to 3.8.0 contains a Incorrect Access Control vulnerability in src/Firebase/Auth/IdTokenVerifier.php does not verify for token signature that can result in JWT with any email address and user ID could be forged from an actual token, or from thin air. This attack appear to be exploitable via Attacker would only need to know email address of the victim on most cases.. This vulnerability appears to have been fixed in 3.8.1.

NVD の説明

Jerome Gamez Firebase Admin SDK for PHP version from 3.2.0 to 3.8.0 contains a Incorrect Access Control vulnerability in src/Firebase/Auth/IdTokenVerifier.php does not verify for token signature that can result in JWT with any email address and user ID could be forged from an actual token, or from thin air. This attack appear to be exploitable via Attacker would only need to know email address of the victim on most cases.. This vulnerability appears to have been fixed in 3.8.1.