What is CVE-2023-3823?

CVE-2023-3823 is a high-severity vulnerability affecting XML functions in PHP versions 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8. This issue relates to the libxml global state, which manages configuration variables such as whether external entities are loaded. Exploiting this vulnerability can lead to the disclosure of local files accessible to PHP, impacting applications, libraries, and servers that parse or interact with XML documents.

Who is impacted by this?

Users of PHP versions 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8 are affected by CVE-2023-3823. This vulnerability impacts systems, including applications, libraries, and servers that parse or interact with XML documents, potentially compromising sensitive information.

What should I do if I'm affected?

What should I do if I’m affected?

If you are affected by CVE-2023-3823, take the following steps to protect your system:

1. Update PHP to the latest patched version (8.0.30 or later).

2. Implement the suggested mitigation in your code: libxml_set_external_entity_loader(function () { return null; });

These actions will help safeguard your system against potential security risks.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

CVE-2023-3823 is not listed in CISA's Known Exploited Vulnerabilities Catalog. This high-severity issue affects XML functions in PHP and can lead to the disclosure of local files. To protect your system, update PHP to the latest patched version and implement the suggested mitigation in your code.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-611, which involves improper restriction of XML external entity reference, affecting various XML functions in PHP.

Learn More

For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD page or the sources listed below.

• GitHub Advisory on PHP XML External Entity Vulnerability

• Debian PHP 7.3 Security Update Announcement

• Fedora 38 PHP Update Information

• NetApp Advisory on PHP Vulnerabilities