CVE-2025-1219

Published Mar 30, 2025

Last updated a day ago

PHP

Overview

AI description

Generated using AI and has not been reviewed by Intruder. May contain errors.

CVE-2025-1219 is a vulnerability in PHP that affects versions 8.1 before 8.1.32, 8.2 before 8.2.28, 8.3 before 8.3.19, and 8.4 before 8.4.5. It occurs when requesting an HTTP resource using the DOM or SimpleXML extensions. The vulnerability stems from the incorrect handling of the content-type header when a redirected resource is requested. Specifically, the wrong content-type header is used to determine the charset. This can lead to the resulting document being parsed incorrectly or bypassing validations. This issue arises because, during HTTP redirects, PHP doesn't properly clear previously captured headers, potentially leading to the use of a content-type header that doesn't correspond to the final HTML body.

Description: In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when requesting a HTTP resource using the DOM or SimpleXML extensions, the wrong content-type header is used to determine the charset when the requested resource performs a redirect. This may cause the resulting document to be parsed incorrectly or bypass validations.
Source: security@php.net
NVD status: Awaiting Analysis

Risk scores

CVSS 4.0

Type: Secondary
Base score: 6.3
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: MEDIUM

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-1116

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 26

Overview

AI description

Risk scores

CVSS 4.0

Weaknesses

Social media

References