CVE-2022-25481

ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter

Medium · published March 20, 2022

CVSS v3.1
4.0
EPSS
5%
Percentile
91.8
In the wild
Unconfirmed
What it is

ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter. This allows attackers to access all system environment parameters from index.php. NOTE: this is disputed by a third party because system environment exposure is an intended feature of the debugging mode.

The record
Technical detail
CVSS v3.1
4.0 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.04748 · 91.8th percentile
Published
2022-03-20T00:00Z
EPSS history
Timeline
  • 20 MAR 00:00Z
    ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter
    cvelistv5