In PHP version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with password_hash() starts with a null byte (\x00), testing a blank string as the password via password_verify() will incorrectly return true.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-612 advisory.

  - Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and     same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a
    __Host- or __Secure- cookie by PHP applications. (CVE-2024-2756)

  - In PHP version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with     password_hash() starts with a null byte (\x00), testing a blank string as the password via     password_verify() will incorrectly return true. (CVE-2024-3096)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3810 advisory.

  - In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site     attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or     `__Secure-` cookie by PHP applications. (CVE-2022-31629)

  - Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and     same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a
    __Host- or __Secure- cookie by PHP applications. (CVE-2024-2756)

  - In PHP version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with     password_hash() starts with a null byte (\x00), testing a blank string as the password via     password_verify() will incorrectly return true. (CVE-2024-3096)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6757-2 advisory.

  - A vulnerability was found in PHP where setting the environment variable PHP_CLI_SERVER_WORKERS to a large     value leads to a heap buffer overflow. (CVE-2022-4900)

  - Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and     same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a
    __Host- or __Secure- cookie by PHP applications. (CVE-2024-2756)

  - In PHP version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with     password_hash() starts with a null byte (\x00), testing a blank string as the password via     password_verify() will incorrectly return true. (CVE-2024-3096)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-5e8ae0def0 advisory.

  - Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and     same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a
    __Host- or __Secure- cookie by PHP applications. (CVE-2024-2756)

  - In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site     attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or     `__Secure-` cookie by PHP applications. (CVE-2022-31629)

  - In PHP version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with     password_hash() starts with a null byte (\x00), testing a blank string as the password via     password_verify() will incorrectly return true. (CVE-2024-3096)

  - In PHP 8.3.* before 8.3.5, function mb_encode_mimeheader() runs endlessly for some inputs that contain     long strings of non-space characters followed by a space. This could lead to a potential DoS attack if a     hostile user sends data to an application that uses this function. (CVE-2024-2757)

  - In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open()     command with array syntax, due to insufficient escaping, if the arguments of the executed command are     controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in     Windows shell. (CVE-2024-1874)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6757-1 advisory.

  - A vulnerability was found in PHP where setting the environment variable PHP_CLI_SERVER_WORKERS to a large     value leads to a heap buffer overflow. (CVE-2022-4900)

  - Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and     same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a
    __Host- or __Secure- cookie by PHP applications. (CVE-2024-2756)

  - In PHP version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with     password_hash() starts with a null byte (\x00), testing a blank string as the password via     password_verify() will incorrectly return true. (CVE-2024-3096)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1444-1 advisory.

  - Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and     same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a
    __Host- or __Secure- cookie by PHP applications. (CVE-2024-2756)

  - In PHP version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with     password_hash() starts with a null byte (\x00), testing a blank string as the password via     password_verify() will incorrectly return true. (CVE-2024-3096)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1446-1 advisory.

  - Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and     same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a
    __Host- or __Secure- cookie by PHP applications. (CVE-2024-2756)

  - In PHP version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with     password_hash() starts with a null byte (\x00), testing a blank string as the password via     password_verify() will incorrectly return true. (CVE-2024-3096)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1445-1 advisory.

  - Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and     same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a
    __Host- or __Secure- cookie by PHP applications. (CVE-2024-2756)

  - In PHP version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with     password_hash() starts with a null byte (\x00), testing a blank string as the password via     password_verify() will incorrectly return true. (CVE-2024-3096)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the version of PHP installed on the remote host is 8.1.x prior to 8.1.28, 8.2.x prior to 8.2.18, or 8.3.x prior to 8.3.6. It is, therefore, affected by multiple vulnerabilities:

 - A command injection via array-ish $command parameter of proc_open. (CVE-2024-1874)

 - __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix. (CVE-2024-2756)

 - password_verify can erroneously return true, opening ATO risk. (CVE-2024-3096)

 - mb_encode_mimeheader runs endlessly for some inputs. (CVE-2024-2757)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-39d50cc975 advisory.

  - Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and     same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a
    __Host- or __Secure- cookie by PHP applications. (CVE-2024-2756)

  - In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site     attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or     `__Secure-` cookie by PHP applications. (CVE-2022-31629)

  - In PHP version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with     password_hash() starts with a null byte (\x00), testing a blank string as the password via     password_verify() will incorrectly return true. (CVE-2024-3096)

  - In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open()     command with array syntax, due to insufficient escaping, if the arguments of the executed command are     controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in     Windows shell. (CVE-2024-1874)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-b46619f761 advisory.

  - Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and     same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a
    __Host- or __Secure- cookie by PHP applications. (CVE-2024-2756)

  - In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site     attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or     `__Secure-` cookie by PHP applications. (CVE-2022-31629)

  - In PHP version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with     password_hash() starts with a null byte (\x00), testing a blank string as the password via     password_verify() will incorrectly return true. (CVE-2024-3096)

  - In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open()     command with array syntax, due to insufficient escaping, if the arguments of the executed command are     controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in     Windows shell. (CVE-2024-1874)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 6d82c5e9-fc24-11ee-a689-04421a1baf97 advisory.

  - This update includes 3 security fixes: (CVE-2024-1874, CVE-2024-2756, CVE-2024-2757, CVE-2024-3096)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5660 advisory.

  - In PHP versions 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8 various XML functions     rely on libxml global state to track configuration variables, like whether external entities are loaded.
    This state is assumed to be unchanged unless the user explicitly changes it by calling appropriate     function. However, since the state is process-global, other modules - such as ImageMagick - may also use     this library within the same process, and change that global state for their internal purposes, and leave     it in a state where external entities loading is enabled. This can lead to the situation where external     XML is parsed with external entities loaded, which can lead to disclosure of any local files accessible to     PHP. This vulnerable state may persist in the same process across many requests, until the process is shut     down. (CVE-2023-3823)

  - In PHP version 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file,     while reading PHAR directory entries, insufficient length checking may lead to a stack buffer overflow,     leading potentially to memory corruption or RCE. (CVE-2023-3824)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5661 advisory.

  - In PHP versions 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8 various XML functions     rely on libxml global state to track configuration variables, like whether external entities are loaded.
    This state is assumed to be unchanged unless the user explicitly changes it by calling appropriate     function. However, since the state is process-global, other modules - such as ImageMagick - may also use     this library within the same process, and change that global state for their internal purposes, and leave     it in a state where external entities loading is enabled. This can lead to the situation where external     XML is parsed with external entities loaded, which can lead to disclosure of any local files accessible to     PHP. This vulnerable state may persist in the same process across many requests, until the process is shut     down. (CVE-2023-3823)

  - In PHP version 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file,     while reading PHAR directory entries, insufficient length checking may lead to a stack buffer overflow,     leading potentially to memory corruption or RCE. (CVE-2023-3824)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of php81 installed on the remote host is prior to 8.1.28 / 8.3.6. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2024-103-01 advisory.

  - In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site     attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or     `__Secure-` cookie by PHP applications. (CVE-2022-31629)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.1.28. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.1.28 advisory.

  - In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site     attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or     `__Secure-` cookie by PHP applications. (CVE-2022-31629)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.3.6. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.3.6 advisory.

  - In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site     attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or     `__Secure-` cookie by PHP applications. (CVE-2022-31629)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.2.18. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.2.18 advisory.

  - In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site     attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or     `__Secure-` cookie by PHP applications. (CVE-2022-31629)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
196930	Amazon Linux 2023 : php8.1, php8.1-bcmath, php8.1-cli (ALAS2023-2024-612)	Nessus	Amazon Linux Local Security Checks	medium
196189	RHEL 7 : php (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
196157	RHEL 6 : php (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
195146	Debian dla-3810 : libapache2-mod-php7.3 - security update	Nessus	Debian Local Security Checks	medium
194949	Ubuntu 20.04 LTS / 22.04 LTS / 23.10 : PHP vulnerabilities (USN-6757-2)	Nessus	Ubuntu Local Security Checks	medium
194645	Fedora 40 : php (2024-5e8ae0def0)	Nessus	Fedora Local Security Checks	medium
194504	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS : PHP vulnerabilities (USN-6757-1)	Nessus	Ubuntu Local Security Checks	medium
194464	SUSE SLES15 / openSUSE 15 Security Update : php7 (SUSE-SU-2024:1444-1)	Nessus	SuSE Local Security Checks	medium
194459	SUSE SLES15 / openSUSE 15 Security Update : php8 (SUSE-SU-2024:1446-1)	Nessus	SuSE Local Security Checks	medium
194457	SUSE SLES12 Security Update : php74 (SUSE-SU-2024:1445-1)	Nessus	SuSE Local Security Checks	medium
114272	PHP 8.1.x < 8.1.28 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
114271	PHP 8.2.x < 8.2.18 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
114270	PHP 8.3.x < 8.3.6 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
193553	Fedora 38 : php (2024-39d50cc975)	Nessus	Fedora Local Security Checks	medium
193549	Fedora 39 : php (2024-b46619f761)	Nessus	Fedora Local Security Checks	medium
193406	FreeBSD : php -- Multiple vulnerabilities (6d82c5e9-fc24-11ee-a689-04421a1baf97)	Nessus	FreeBSD Local Security Checks	critical
193347	Debian dsa-5660 : libapache2-mod-php7.4 - security update	Nessus	Debian Local Security Checks	critical
193346	Debian dsa-5661 : libapache2-mod-php8.2 - security update	Nessus	Debian Local Security Checks	critical
193284	Slackware Linux 15.0 / current php81 Multiple Vulnerabilities (SSA:2024-103-01)	Nessus	Slackware Local Security Checks	medium
193283	PHP 8.1.x < 8.1.28 Multiple Vulnerabilities	Nessus	CGI abuses	medium
193201	PHP 8.3.x < 8.3.6 Multiple Vulnerabilities	Nessus	CGI abuses	medium
193191	PHP 8.2.x < 8.2.18 Multiple Vulnerabilities	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2024-3096

medium

Tenable Plugins

medium

critical

critical

medium

medium

medium

medium

medium

medium

medium

critical

critical

critical

medium

medium

critical

critical

critical

medium

medium

medium

medium