FrankenPHP before 1.13.2 Information Disclosure via libxml Error State in Worker Mode
概要
FrankenPHP before 1.13.2 contains an information disclosure vulnerability that allows later clients to read earlier clients' libxml errors because worker mode never resets LIBXML(error_list) between requests. Attackers sending requests to the same worker thread can call libxml_get_errors() or libxml...
影響パッケージ
| パッケージ | 影響を受ける版 → 修正版 | |
|---|---|---|
| phpfrankenphp |
1.13.2 未満→ 1.13.2 |
1.13.2 |
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
FrankenPHP before 1.13.2 contains an information disclosure vulnerability that allows later clients to read earlier clients' libxml errors because worker mode never resets LIBXML(error_list) between requests. Attackers sending requests to the same worker thread can call libxml_get_errors() or libxml_get_last_error() to obtain other clients' parsed-document fragments and server filesystem paths.
出典: CVE.org (CVE Program・cvelistV5) NVD