Description

In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify() function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database, it may lead to an application allowing any password for this entry as valid.

Remediation

References

CVE-2023-0567

Related Vulnerabilities

Joomla! Core Cross-Site Scripting (1.5.0 - 3.8.3)

WebLogic CVE-2018-2998 Vulnerability (CVE-2018-2998)

MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2013-4574)

Nginx Out-of-bounds Write Vulnerability (CVE-2022-41742)

WordPress CVE-2012-2399 Vulnerability (CVE-2012-2399)

Severity

Medium

Classification

CVE-2023-0567 CWE-916 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update Known Vulnerabilities