Vulnerability Details CVE-2017-7189
main/streams/xp_socket.c in PHP 7.x before 2017-03-07 misparses fsockopen calls, such as by interpreting fsockopen('127.0.0.1:80', 443) as if the address/port were 127.0.0.1:80:443, which is later truncated to 127.0.0.1:80. This behavior has a security risk if the explicitly provided port number (i.e., 443 in this example) is hardcoded into an application as a security policy, but the hostname argument (i.e., 127.0.0.1:80 in this example) is obtained from untrusted input.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.011
EPSS Ranking 77.7%
CVSS Severity
CVSS v3 Score 7.5
CVSS v2 Score 5.0
References
Products affected by CVE-2017-7189
-
cpe:2.3:a:php:php:7.0.0
-
cpe:2.3:a:php:php:7.0.1
-
cpe:2.3:a:php:php:7.0.10
-
cpe:2.3:a:php:php:7.0.11
-
cpe:2.3:a:php:php:7.0.12
-
cpe:2.3:a:php:php:7.0.13
-
cpe:2.3:a:php:php:7.0.14
-
cpe:2.3:a:php:php:7.0.15
-
cpe:2.3:a:php:php:7.0.2
-
cpe:2.3:a:php:php:7.0.3
-
cpe:2.3:a:php:php:7.0.4
-
cpe:2.3:a:php:php:7.0.5
-
cpe:2.3:a:php:php:7.0.6
-
cpe:2.3:a:php:php:7.0.7
-
cpe:2.3:a:php:php:7.0.8
-
cpe:2.3:a:php:php:7.0.9