points by mischanix 2 days ago | 0 comments
How is this a 9.5 if php2shell was a 9.2?
[–] verandaguy 2 days ago
[–] gnabgib 2 days ago
The PHP CVS were originally reported as perfect 10s and in theory allow remote access (practically all of the internet). This requires physical hardware access (practically 0 of the internet).
Those original PHP 10s were negotiated down into a 9.2 by disclosure.. so maybe this'll be an 8.7 soon.
[–] merb 2 days ago
Well because some php configurations had an absurdly low default max upload size, which made the rce way harder.
Plesk for example ships with 2m for some reason.
[–] dns_snek 2 days ago
The fact that a subset of systems are in a less vulnerable configuration doesn't have any bearing on the CVSS score.
> Specific configurations should not impact any attribute contributing to the CVSS Base metric assessment , i.e., if a specific configuration is required for an attack to succeed, the vulnerable system should be assessed assuming it is in that configuration. [1]
For a vulnerability to score a 10 its Attack Complexity must be 'Low' (broadly speaking: it doesn't require target-specific customizations or mitigations [1]), which isn't the case with php2shell.
Here's a breakdown of that 9.2: https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:H...
[1] https://www.first.org/cvss/v4.0/specification-document#Attac...
[–] loeg 2 days ago
CVSS scores are essentially meaningless. Don't read anything into it.
[–] phoe-krk 2 days ago
Check it yourself: paste CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H into a CVSS analyser and read the descriptions of the related categories.
Even before AI, there was prestige in being able to say that you (or your team) found a 9.2 in some major piece of software. You could put that on your resume in some specializations.
Now with AI vulnerability scanning being so hyper-commercialized (but not yet fully commoditized), this is cranked way up since there are more monied interests involved, and many of them are probably trying to make a quick buck before LLM-based vulnerability scans are a commodity (for better or worse).