Unrated severityNVD Advisory· Published Mar 6, 2013· Updated Jun 16, 2026
CVE-2013-1635
CVE-2013-1635
Description
ext/soap/soap.c in PHP before 5.3.22 and 5.4.x before 5.4.13 does not validate the relationship between the soap.wsdl_cache_dir directive and the open_basedir directive, which allows remote attackers to bypass intended access restrictions by triggering the creation of cached SOAP WSDL files in an arbitrary directory.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
141cpe:2.3:a:php:php:*:*:*:*:*:*:*:*+ 137 more
- cpe:2.3:a:php:php:*:*:*:*:*:*:*:*range: <=5.3.21
- cpe:2.3:a:php:php:1.0:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:2.0:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:2.0b10:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:3.0:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:3.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:3.0.10:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:3.0.11:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:3.0.12:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:3.0.13:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:3.0.14:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:3.0.15:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:3.0.16:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:3.0.17:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:3.0.18:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:3.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:3.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:3.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:3.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:3.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:3.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:3.0.8:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:3.0.9:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.0:beta2:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.0:beta3:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.0:beta4:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.0:beta_4_patch1:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.3.10:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.3.11:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.3.4:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.3.5:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.3.6:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.3.7:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.3.8:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.3.9:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.4.3:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.4.4:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.4.5:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.4.6:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.4.7:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.4.8:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.4.9:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.0.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.0.0:beta2:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.0.0:beta3:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.0.0:beta4:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.0.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.0.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.0.0:rc3:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.1.5:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.1.6:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.10:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.11:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.12:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.13:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.14:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.15:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.16:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.17:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.5:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.6:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.7:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.8:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.9:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.10:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.11:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.12:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.13:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.14:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.15:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.16:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.17:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.18:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.19:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.20:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.4:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.5:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.6:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.7:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.8:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.9:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.4.10:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.4.11:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.4.12:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.4.3:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.4.4:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.4.5:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.4.6:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.4.7:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.4.8:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.4.9:*:*:*:*:*:*:*
- (no CPE)range: <5.3.22, <5.4.13
- osv-coords3 versionspkg:rpm/opensuse/php5&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/php7&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/php8&distro=openSUSE%20Tumbleweed
< 5.6.28-1.1+ 2 more
- (no CPE)range: < 5.6.28-1.1
- (no CPE)range: < 7.0.14-1.4
- (no CPE)range: < 8.0.11-1.1
Patches
Vulnerability mechanics
References
11- bugs.debian.org/cgi-bin/bugreport.cginvd
- git.php.netnvd
- lists.apple.com/archives/security-announce/2013/Sep/msg00002.htmlnvd
- lists.opensuse.org/opensuse-security-announce/2013-07/msg00034.htmlnvd
- lists.opensuse.org/opensuse-security-announce/2013-08/msg00006.htmlnvd
- support.apple.com/kb/HT5880nvd
- www.debian.org/security/2013/dsa-2639nvd
- www.mandriva.com/security/advisoriesnvd
- bugs.gentoo.org/show_bug.cginvd
- bugzilla.redhat.com/show_bug.cginvd
- wiki.mageia.org/en/Support/Advisories/MGASA-2013-0101nvd
News mentions
0No linked articles in our index yet.