Description

In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify() function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database, it may lead to an application allowing any password for this entry as valid.

Remediation

References

CVE-2023-0567

Related Vulnerabilities

WordPress Plugin DB Toolkit 'uploadify.php' Arbitrary File Upload (0.1.10)

Dolibarr Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2016-1912)

Jenkins Missing Authorization Vulnerability (CVE-2019-10354)

WordPress Plugin NextScripts:Social Networks Auto-Poster Cross-Site Scripting (4.3.23)

ATutor Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2019-12169)

Severity

Medium

Classification

CVE-2023-0567 CWE-916 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Tags

Missing Update Known Vulnerabilities