VULNERABILITY INTELLIGENCE
CVE-2023-0567
CVSS score7.7 HIGH
EPSS probability0.92%
CISA KEVNot currently listed
Published2023-03-01
Last modified2026-07-19
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Description
In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify() function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database, it may lead to an application allowing any password for this entry as valid.
Weakness classification
- nvd@nist.gov: CWE-916
- 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-916
Primary references
- security@php.net — Vendor Advisory
- security@php.net — Exploit, Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Exploit, Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108