CVE-2017-7272

2017-03-2717:59:00

Google

osv.dev

6.7 Medium

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

66.0%

JSON

PHP through 7.1.11 enables potential SSRF in applications that accept an fsockopen or pfsockopen hostname argument with an expectation that the port number is constrained. Because a :port syntax is recognized, fsockopen will use the port number that is specified in the hostname argument, instead of the port number in the second argument of the function.

CPENameOperatorVersion
php-srceqNEWS
php-srceqPRE_PHP7_EREG_MYSQL_REMOVALS
php-srceqPOST_64BIT_BRANCH_MERGE
php-srceqphp-5.6.19RC1
php-srceqphp-5.3.29
php-srceqphp-7.0.13RC1
php-srceqphp-7.0.12RC1
php-srceqphp-5.4.32RC1
php-srceqphp-5.3.29RC1
php-srceqPOST_PHP7_REMOVALS

Name	Operator	Version
php-src	eq	NEWS
php-src	eq	PRE_PHP7_EREG_MYSQL_REMOVALS
php-src	eq	POST_64BIT_BRANCH_MERGE
php-src	eq	php-5.6.19RC1
php-src	eq	php-5.3.29
php-src	eq	php-7.0.13RC1
php-src	eq	php-7.0.12RC1
php-src	eq	php-5.4.32RC1
php-src	eq	php-5.3.29RC1
php-src	eq	POST_PHP7_REMOVALS