CVE-2007-5900 : PHP before 5.2.5 allows local users to bypass protection mechanisms configured t

PHP before 5.2.5 allows local users to bypass protection mechanisms configured through php_admin_value or php_admin_flag in httpd.conf by using ini_set to modify arbitrary configuration variables, a different issue than CVE-2006-4625.

Published 2007-11-20 18:46:00

Updated 2018-10-15 21:47:03

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2007-5900

PHP » PHP
Versions up to, including, (<=) 5.2.4
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2007-5900

Top countries where our scanners detected CVE-2007-5900

Top open port discovered on systems with this issue 80

IPs affected by CVE-2007-5900 7,352

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2007-5900!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2007-5900

EPSS FAQ

0.05%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 13 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2007-5900

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
6.9	MEDIUM	AV:L/AC:M/Au:N/C:C/I:C/A:C	3.4	10.0	NIST
Access Vector: Local Access Complexity: Medium Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete

CWE ids for CVE-2007-5900

CWE-264

Assigned by: nvd@nist.gov (Primary)

Vendor statements for CVE-2007-5900

Red Hat 2007-11-21

The PHP interpreter does not offer a reliable "sandboxed" security layer (as found in, say, a JVM) in which untrusted scripts can be run; any script run by the PHP interpreter must be trusted with the privileges of the interpreter itself. We therefore do not classify this issue as security-sensitive since no trust boundary is crossed.

References for CVE-2007-5900

Jump to