Exposure of Resource to Wrong Sphere in ThinkPHP Framework

높음 7.5CVE-2022-25481 · GHSA-69wp-xwm7-69wm · Published 21/03/2022 · updated 17/06/2026

요약

CVE-2022-25481은(는) topthink/framework, thinkphp (thinkphp)에 영향을 주는 높음 (CVSS 7.5) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 4.7%, 전체 취약점의 91.9%보다 높음.
아직 패치 버전 정보가 없습니다. 참고 자료의 공급업체 권고를 확인하세요.

Package	Affected versions	Patched versions
topthink/framework Packagist	`≤ 5.0.24`	No fix yet
thinkphp thinkphp	`= 5.0.24`	No fix yet

Description

ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter. This allows attackers to access all system environment parameters from index.php.

NVD description

ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter. This allows attackers to access all system environment parameters from index.php. NOTE: this is disputed by a third party because system environment exposure is an intended feature of the debugging mode.

References

nvd.nist.gov/vuln/detail/CVE-2022-25481 · ADVISORY
Lyther/VulnDiscover · WEB
top-think/framework · PACKAGE

topthink/framework의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

요약

CVE-2022-25481은(는) topthink/framework, thinkphp (thinkphp)에 영향을 주는 높음 (CVSS 7.5) 취약점입니다.

향후 30일 내 악용 확률(EPSS): 4.7%, 전체 취약점의 91.9%보다 높음.

아직 패치 버전 정보가 없습니다. 참고 자료의 공급업체 권고를 확인하세요.

Package

Affected versions

Patched versions

topthink/framework

Packagist

≤ 5.0.24

No fix yet

thinkphp

= 5.0.24

No fix yet

Description

ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter. This allows attackers to access all system environment parameters from index.php.

NVD description

topthink/framework의 다른 취약점

모두 보기 →