CVE-2017-7272
HIGHPHP < 7.1.3 - Server-Side Request Forgery via fsockopen/pfsockopen Port Parsing
Title source: manualDescription
PHP through 7.1.11 enables potential SSRF in applications that accept an fsockopen or pfsockopen hostname argument with an expectation that the port number is constrained. Because a :port syntax is recognized, fsockopen will use the port number that is specified in the hostname argument, instead of the port number in the second argument of the function.
References (7)
Core 7
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/97178
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id/1038158
Various Sources x_refsource_confirm
https://bugs.php.net/bug.php?id=75505
Issue Tracking, Patch, Third Party Advisory x_refsource_confirm
https://github.com/php/php-src/commit/bab0b99f376dac9170ac81382a5ed526938d595a
Vendor Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20180112-0001/
Various Sources x_refsource_misc
https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170403-0_PHP_Misbehavior_of_fsockopen_function_v10.txt
Issue Tracking, Vendor Advisory x_refsource_confirm
https://bugs.php.net/bug.php?id=74216
Scores
CVSS v3
7.4
EPSS
0.0111
EPSS Percentile
78.3%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Details
CWE
CWE-918
Status
published
Products (1)
php/php
< 7.1.3
Published
Mar 27, 2017
Tracked Since
Feb 18, 2026