CVE-2023-0567

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-0567

7.7 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.5 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

I

n PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify() function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database, it may lead to an application allowing any password for this entry as valid.

References
Link Resource
https://bugs.php.net/bug.php?id=81744 Vendor Advisory
https://github.com/php/php-src/security/advisories/GHSA-7fj2-8x79-rjf4 Exploit Vendor Advisory
https://bugs.php.net/bug.php?id=81744 Vendor Advisory
https://github.com/php/php-src/security/advisories/GHSA-7fj2-8x79-rjf4 Exploit Vendor Advisory
https://security.netapp.com/advisory/ntap-20230331-0008/
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
History

25 Feb 2026, 17:17

Type Values Removed Values Added
Summary (en) In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify() function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database, it may lead to an application allowing any password for this entry as valid.  (en) In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify() function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database, it may lead to an application allowing any password for this entry as valid.

21 Nov 2024, 07:37

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 6.2 		v2 : unknown
v3 : 7.7
References
  • () https://security.netapp.com/advisory/ntap-20230331-0008/ -
References () https://bugs.php.net/bug.php?id=81744 - Vendor Advisory () https://bugs.php.net/bug.php?id=81744 - Vendor Advisory
References () https://github.com/php/php-src/security/advisories/GHSA-7fj2-8x79-rjf4 - Exploit, Vendor Advisory () https://github.com/php/php-src/security/advisories/GHSA-7fj2-8x79-rjf4 - Exploit, Vendor Advisory
Information

Published : 2023-03-01 08:15

Updated : 2026-02-25 17:17

NVD link : CVE-2023-0567

Mitre link : CVE-2023-0567

CVE.ORG link : CVE-2023-0567

JSON object : View

Products Affected

php

CWE
CWE-916

Use of Password Hash With Insufficient Computational Effort