CVE-2022-31140 Valinor error messages leading to potential data exfiltration
Attackers can extract sensitive data like database credentials or SQL snippets via error messages in the Valinor PHP library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-31140?
CVE-2022-31140 is a high-severity vulnerability in CuyZ Valinor, published on 11 Jul 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Valinor is a PHP library that helps to map any input into a strongly-typed value object structure. Prior to version 0.12.0, Valinor can use `Throwable#getMessage()` when it should not have permission to do so. This is a problem with cases such as an SQL exception showing an SQL snippet, a database connection exception showing database IP address/username/password, or a timeout detail / out of memory detail. Attackers could use this information for potential data exfiltration, denial of service attacks, enumeration attacks, etc. Version 0.12.0 contains a patch for this vulnerability.
Weakness: CWE-209
Which versions are affected by CVE-2022-31140?
2 open source packages ship an affected version, including cuyz/valinor. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
cuyz/valinor Packagist | All versions | 0.12.0 |
cuyz/valinor Packagist | All versions | 0.12.0 |
Products include Cuyz Valinor.
How do I fix CVE-2022-31140?
Upgrade cuyz/valinor to 0.12.0 or later.
Is CVE-2022-31140 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-31140 exists.
Sources
Also known as GHSA-5pgm-3j3g-2rc7.