Description

ext/soap/soap.c in PHP before 5.3.22 and 5.4.x before 5.4.13 does not validate the relationship between the soap.wsdl_cache_dir directive and the open_basedir directive, which allows remote attackers to bypass intended access restrictions by triggering the creation of cached SOAP WSDL files in an arbitrary directory.

Remediation

References

CVE-2013-1635

Related Vulnerabilities

Joomla Missing Authorization Vulnerability (CVE-2020-10239)

WordPress Plugin Cimy User Extra Fields Denial of Service (2.6.3)

Joomla! Core 3.x.x Open Redirect (3.0.0 - 3.9.20)

PleskWin Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-18793)

MyBB Improper Neutralization of Special Elements used in a Command ('Command Injection') Vulnerability (CVE-2022-39265)

Severity

High

Classification

CVE-2013-1635 CWE-264

Tags

Missing Update Known Vulnerabilities