1. Home
  2. CVE Database
  3. CVE-2021-21704
MEDIUM · 5.0

CVE-2021-21704

In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using Firebird PDO driver extension, a malicious database server could cause crashes in various database functions, s...

Vulnerability Description

In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using Firebird PDO driver extension, a malicious database server could cause crashes in various database functions, such as getAttribute(), execute(), fetch() and others by returning invalid response data that is not parsed correctly by the driver. This can result in crashes, denial of service or potentially memory corruption.

CVSS Score

5.0

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
LOW

Affected Products

VendorProductVersions
PhpPhp>= 7.3.0, < 7.3.29
NetappClustered Data Ontap-

Related Weaknesses (CWE)

CWE-787CWE-190CWE-125

References

FAQ

What is CVE-2021-21704?

CVE-2021-21704 is a vulnerability with a CVSS score of 5.0 (MEDIUM). In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using Firebird PDO driver extension, a malicious database server could cause crashes in various database functions, s...

How severe is CVE-2021-21704?

CVE-2021-21704 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-21704?

Check the references section above for vendor advisories and patch information. Affected products include: Php Php, Netapp Clustered Data Ontap.