FrankenPHP before 1.13.4 Information Disclosure via Per-Request Environment Variable Leak
概要
FrankenPHP before 1.13.4 contains an information disclosure vulnerability in worker mode that leaks per-request environment variables into later requests on the same PHP thread. Attackers can read values set via env directives with request placeholders or WithRequestEnv() through getenv() or $_SERVE...
影響パッケージ
| パッケージ | 影響を受ける版 → 修正版 | |
|---|---|---|
| phpfrankenphp |
1.13.4 未満→ 1.13.4 |
1.13.4 |
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
FrankenPHP before 1.13.4 contains an information disclosure vulnerability in worker mode that leaks per-request environment variables into later requests on the same PHP thread. Attackers can read values set via env directives with request placeholders or WithRequestEnv() through getenv() or $_SERVER, causing applications to act on another user's routing, tenant, or authorization values.
出典: CVE.org (CVE Program・cvelistV5) NVD