blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2023-0567

MEDIUM 6.2 CVSS 3.1
Published
March 1, 2023
Last modified
July 19, 2026
NVD status
Modified
Reported by
security@php.net
Weakness
CWE-916
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Description

In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify() function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database, it may lead to an application allowing any password for this entry as valid.

Affected products and versions

  • PHP — From 8.0.0 (including) to 8.0.28 (excluding)
  • PHP — From 8.1.0 (including) to 8.1.16 (excluding)
  • PHP — From 8.2.0 (including) to 8.2.3 (excluding)

References

  • bugs.php.net https://bugs.php.net/bug.php?id=81744 Vendor Advisory
  • github.com https://github.com/php/php-src/security/advisories/GHSA-7fj2-8x79-rjf4 Exploit, Vendor Advisory
  • security.netapp.com https://security.netapp.com/advisory/ntap-20230331-0008/
  • nvd.nist.gov Official NVD record