CVE-2017-7272

Severity: high (CVSS 7.4 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-03-27 · updated 2026-06-17
Weakness: CWE-918

Description

PHP through 7.1.11 enables potential SSRF in applications that accept an fsockopen or pfsockopen hostname argument with an expectation that the port number is constrained. Because a :port syntax is recognized, fsockopen will use the port number that is specified in the hostname argument, instead of the port number in the second argument of the function.

Affected products

PHP: through 7.1.3

References

http://www.securityfocus.com/bid/97178
http://www.securitytracker.com/id/1038158
https://bugs.php.net/bug.php?id=74216
https://bugs.php.net/bug.php?id=75505
https://github.com/php/php-src/commit/bab0b99f376dac9170ac81382a5ed526938d595a
https://security.netapp.com/advisory/ntap-20180112-0001/
https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170403-0_PHP_Misbehavior_of_fsockopen_function_v10.txt
http://www.securityfocus.com/bid/97178
http://www.securitytracker.com/id/1038158
https://bugs.php.net/bug.php?id=74216
https://bugs.php.net/bug.php?id=75505
https://github.com/php/php-src/commit/bab0b99f376dac9170ac81382a5ed526938d595a

Get alerted when CVE-2017-7272 or the next vulnerability affects your stack