CVE-2003-0249
PHP treats unknown methods such as "PoSt" as a GET request, which could allow attackers to intended access restrictions if PHP is running o…
Published 22 y ago · modified 4 mo ago · JSON
Summary
PHP treats unknown methods such as "PoSt" as a GET request, which could allow attackers to intended access restrictions if PHP is running on a server that passes on all methods, such as Apache httpd 2.0, as demonstrated using a Limit directive. NOTE: this issue has been disputed by the Apache security team, saying "It is by design that PHP allows scripts to process any request method. A script which does not explicitly verify the request method will hence be processed as normal for arbitrary methods. It is therefore expected behaviour that one cannot implement per-method access control using the Apache configuration alone, which is the assumption made in this report.
Exploit prediction (EPSS)
1.23% probability of exploitation in the next 30 days, higher than 69% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Classification
- Technology feeds
- PHP (RSS, critical only)
References
- idefense.com /intelligence/vulnerabilities/display.php?id=97 · third-party-advisory, x_refsource_IDEFENSE, x_transferred
Sources
- CVE List: CVE-2003-0249
- NVD: CVE-2003-0249
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.