1. Home
  2. CVE Database
  3. CVE-2022-25481
HIGH · 7.5

CVE-2022-25481

ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter. This allows attackers to access all system environment parameters from index.php. NOTE: this is disputed by a...

Vulnerability Description

ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter. This allows attackers to access all system environment parameters from index.php. NOTE: this is disputed by a third party because system environment exposure is an intended feature of the debugging mode.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
ThinkphpThinkphp5.0.24

Related Weaknesses (CWE)

CWE-668CWE-284

References

FAQ

What is CVE-2022-25481?

CVE-2022-25481 is a vulnerability with a CVSS score of 7.5 (HIGH). ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter. This allows attackers to access all system environment parameters from index.php. NOTE: this is disputed by a...

How severe is CVE-2022-25481?

CVE-2022-25481 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-25481?

Check the references section above for vendor advisories and patch information. Affected products include: Thinkphp Thinkphp.