2 lines
5.1 KiB
JSON
2 lines
5.1 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"PHP","vendor":"PHP Group","versions":[{"lessThan":"8.1.32","status":"affected","version":"8.1.*","versionType":"semver"},{"lessThan":"8.2.28","status":"affected","version":"8.2.*","versionType":"semver"},{"lessThan":"8.3.19","status":"affected","version":"8.3.*","versionType":"semver"},{"lessThan":"8.4.5","status":"affected","version":"8.4.*","versionType":"semver"}]}],"source":"security@php.net"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","matchCriteriaId":"240B9DA6-4FE3-42D1-931A-9F4C62EC0ABA","versionEndExcluding":"8.1.32","versionStartIncluding":"8.1.0","vulnerable":true},{"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","matchCriteriaId":"3C01313A-447A-4190-B275-3A6394EEFD96","versionEndExcluding":"8.2.28","versionStartIncluding":"8.2.0","vulnerable":true},{"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","matchCriteriaId":"A525415D-4C9F-4884-9F85-94989608D805","versionEndExcluding":"8.3.19","versionStartIncluding":"8.3.0","vulnerable":true},{"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","matchCriteriaId":"AC94B1EC-530A-4A25-9BCD-DAC5F52F6813","versionEndExcluding":"8.4.5","versionStartIncluding":"8.4.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when requesting a HTTP resource using the DOM or SimpleXML extensions, the wrong content-type header is used to determine the charset when the requested resource performs a redirect. This may cause the resulting document to be parsed incorrectly or bypass validations."},{"lang":"es","value":"En PHP (versión 8.1.* anterior a 8.1.32, 8.2.* anterior a 8.2.28, 8.3.* anterior a 8.3.19 y 8.4.* anterior a 8.4.5), al solicitar un recurso HTTP mediante las extensiones DOM o SimpleXML, se utiliza un encabezado de tipo de contenido incorrecto para determinar el conjunto de caracteres cuando el recurso solicitado realiza una redirección. Esto puede provocar que el documento resultante se analice incorrectamente o que se omitan las validaciones."}],"id":"CVE-2025-1219","lastModified":"2026-06-17T08:38:37.590","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@php.net","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-1219","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2025-03-31T13:10:21.300276Z","version":"2.0.3"}}]},"published":"2025-03-30T06:15:13.570","references":[{"source":"security@php.net","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/php/php-src/security/advisories/GHSA-p3x9-6h7p-cgfc"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00014.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://security.netapp.com/advisory/ntap-20250523-0007/"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/php/php-src/security/advisories/GHSA-p3x9-6h7p-cgfc"}],"sourceIdentifier":"security@php.net","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-1116"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
|