CVE-2021-21702

Advisory lineage Upstream: 0 Downstream: 19
Modified
Published: 15 Feb 2021, 04:10
Last modified:16 Sept 2024, 17:34

Vulnerability Summary

Overall Risk (default)
medium
30/100
CVSS Score
7.5 HIGH
v3.1 (nvd)
EPSS Score
0.27% LOW
0% probability +0.02%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

15 Feb 2021, 04:10
Published
Vulnerability first disclosed
16 Sept 2024, 17:34
Last Modified
Vulnerability information updated

Description

In PHP versions 7.3.x below 7.3.27, 7.4.x below 7.4.15 and 8.0.x below 8.0.2, when using SOAP extension to connect to a SOAP server, a malicious SOAP server could return malformed XML data as a response that would cause PHP to access a null pointer and thus cause a crash.

CVSS Metrics

  • v3.1•MEDIUM•Score: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • v2.0•MEDIUM•Score: 5AV:N/AC:L/Au:N/C:N/I:N/A:P

EPSS Trends

Current EPSS score: 0.27%• Percentile: 51%

Techniques & Countermeasures

  • CWE-476•NULL Pointer Dereference

    The product dereferences a pointer that it expects to be valid but is NULL.

Affected Systems

  • debian•debian_linux

    9.0 | 10.0

  • netapp•clustered_data_ontap

    na

  • oracle•communications_diameter_signaling_router

    ≥ 8.0.0, ≤ 8.5.0

  • Unknown•PHP

    ≥ 7.3.x, < 7.3.27 | ≥ 7.4.x, < 7.4.15 | ≥ 8.0.X, < 8.0.2

  • Unknown•PHP

    ≥ 7.3.0, < 7.3.27 | ≥ 7.4.0, < 7.4.15 | ≥ 8.0.0, < 8.0.2

References (7)