CVE-2013-1635

ext/soap/soap.c in PHP before 5.3.22 and 5.4.x before 5.4.13 does not validate the relationship between the soap.wsdl_cache_dir directive and the open_basedir…

published March 6, 2013

CVSS

—

EPSS

10%

Percentile

95.5

In the wild

Unconfirmed

What it is

ext/soap/soap.c in PHP before 5.3.22 and 5.4.x before 5.4.13 does not validate the relationship between the soap.wsdl_cache_dir directive and the open_basedir directive, which allows remote attackers to bypass intended access restrictions by triggering the creation of cached SOAP WSDL files in an arbitrary directory.

The record

Technical detail

CVSS: Not scored
CVSS v4.0: Not supplied
EPSS: 0.09747 · 95.5th percentile
Published: 2013-03-06T11:00Z

EPSS history

Timeline

06 MAR 11:00Z
ext/soap/soap.c in PHP before 5.3.22 and 5.4.x before 5.4.13 does not validate the relationship between the soap.wsdl_cache_dir directive and the open_basedir…
cvelistv5