CVE-2022-25769CWE-1284
Improper regex in htaccess file
High · published September 18, 2024
What it is
ImpactThe default .htaccess file has some restrictions in the access to PHP files to only allow specific PHP files to be executed in the root of the application.
This logic isn't correct, as the regex in the second FilesMatch only checks the filename, not the full path.
The record
Technical detail
- CVSS v3.1
- 7.2 · HIGH
- Vector
- CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H
- CVSS v4.0
- Not supplied
- EPSS
- 0.00503 · 42.1th percentile
- Weakness
- CWE-1284 · Improper Validation of Specified Quantity in Input
- Published
- 2024-09-18T14:47Z
EPSS history
Timeline