CVE-2023-0662 : In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, excessiv

In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, excessive number of parts in HTTP form upload can cause high resource consumption and excessive number of log entries. This can cause denial of service on the affected server by exhausting CPU resources or disk space.

Published 2023-02-16 07:15:11

Updated 2023-05-17 20:15:10

Source PHP Group

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2023-0662

PHP » PHP
Versions from including (>=) 8.2.0 and before (<) 8.2.3
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Matching versions
PHP » PHP
Versions from including (>=) 8.0.0 and before (<) 8.0.28
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Matching versions
PHP » PHP
Versions from including (>=) 8.1.0 and before (<) 8.1.16
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2023-0662

Top countries where our scanners detected CVE-2023-0662

Top open port discovered on systems with this issue 80

IPs affected by CVE-2023-0662 95,483

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2023-0662!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2023-0662

EPSS FAQ

0.06%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 30 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-0662

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	PHP Group
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2023-0662

CWE-400 Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Assigned by:
- nvd@nist.gov (Primary)
- security@php.net (Secondary)

References for CVE-2023-0662

https://github.com/php/php-src/security/advisories/GHSA-54hq-v5wp-fqgv

DoS vulnerability when parsing multipart request body · Advisory · php/php-src · GitHub
Third Party Advisory
https://security.netapp.com/advisory/ntap-20230517-0001/

February 2023 PHP Vulnerabilities in NetApp Products | NetApp Product Security

CVEs referencing this url