FrankenPHP before 1.13.2 Information Disclosure via libxml Error State in Worker Mode
Summary
FrankenPHP before 1.13.2 contains an information disclosure vulnerability that allows later clients to read earlier clients' libxml errors because worker mode never resets LIBXML(error_list) between requests. Attackers sending requests to the same worker thread can call libxml_get_errors() or libxml...
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| phpfrankenphp |
< 1.13.2→ 1.13.2 |
1.13.2 |
Original description The description as published by the source.
FrankenPHP before 1.13.2 contains an information disclosure vulnerability that allows later clients to read earlier clients' libxml errors because worker mode never resets LIBXML(error_list) between requests. Attackers sending requests to the same worker thread can call libxml_get_errors() or libxml_get_last_error() to obtain other clients' parsed-document fragments and server filesystem paths.
Source: CVE.org (CVE Program・cvelistV5) NVD