peter bassill · operator
$ cve CVE-2010-0397 JSON

CVE-2010-0397 EXPLOIT

5.0
MEDIUM · CVSS 2.0 · EPSS 11.5% (pctl 96)

Patch early

A public exploit exists.

Description

The xmlrpc extension in PHP 5.3.1 does not properly handle a missing methodName element in the first argument to the xmlrpc_decode_request function, which allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) and possibly have unspecified other impact via a crafted argument.

Scoring

CVSS5.0 (MEDIUM, v2.0)
VectorAV:N/AC:L/Au:N/C:N/I:N/A:P
EPSS11.53% — more likely to be exploited than 96% of all CVEs
On CISA KEVno
Public exploityes
Published2010-03-16
Last modified2026-06-16

Affected (1)

VendorProduct
phpphp

Public exploits

SourceTitleDate
exploit-dbPHP 5.3.2 'xmlrpc' Extension - Multiple Remote Denial of Service Vulnerabilities2010-03-12

References

→ the Explorer  ·  watch your stack  ·  NVD