« Volver al listado

CVE-2013-6919

Estado: ModificadaMedia (4.3)—

The default configuration of phpThumb before 1.7.12 has a false value for the disable_debug option, which allows remote attackers to conduct Server-Side Request Forgery (SSRF) attacks via the src parameter.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Phpthumb Project — Phpthumb

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2013-6919",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-12-27T18:59:07.070",
  "references": [
    {
      "url": "http://www.rafayhackingarticles.net/2013/11/phpthumb-server-side-request-forgery.html",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/JamesHeinrich/phpThumb/blob/master/docs/phpthumb.changelog.txt",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.rafayhackingarticles.net/2013/11/phpthumb-server-side-request-forgery.html",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/JamesHeinrich/phpThumb/blob/master/docs/phpthumb.changelog.txt",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The default configuration of phpThumb before 1.7.12 has a false value for the disable_debug option, which allows remote attackers to conduct Server-Side Request Forgery (SSRF) attacks via the src parameter."
    },
    {
      "lang": "es",
      "value": "La configuración por defecto de phpThumb anterior a 1.7.12 tiene un valor falso en la opción disable_debug, lo que permite a atacantes remotos dirigir ataques Server-Side Request Forgery (SSRF) a través del parámetro src."
    }
  ],
  "lastModified": "2026-06-17T00:01:07.860",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:phpthumb_project:phpthumb:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3F369D9B-ED1E-4681-BCAF-155C08260027",
              "versionEndIncluding": "1.7.11"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "evaluatorComment": "<a href=\"http://cwe.mitre.org/data/definitions/918.html\">CWE-918: Server-Side Request Forgery (SSRF)</a>",
  "sourceIdentifier": "cve@mitre.org"
}