Security readout for executives and security teams
Plain-English summary
A PHP password-checking bug can make some invalid Blowfish password hashes verify as correct. If one of these bad hashes is stored for a user, the application may accept any password for that account. This is mainly urgent for PHP applications that store or import bcrypt/Blowfish-style password hashes.
Executive priority
Treat as high priority for PHP-based login systems because a single malformed stored hash could bypass password checks for that account. Upgrade affected PHP runtimes and check authentication databases where business-critical accounts are stored.
Technical view
CVE-2023-0567 affects PHP 8.0 before 8.0.28, 8.1 before 8.1.16, and 8.2 before 8.2.3. The password_verify() function may return true for some invalid Blowfish hashes. The issue is classified under CWE-916 and has CVSS 3.1 score 8.1.
Likely exposure
Exposure is likely where affected PHP versions run authentication code using password_verify() against Blowfish/bcrypt hashes, especially if hashes can be imported, migrated, corrupted, or otherwise stored incorrectly. Systems not using affected PHP versions or not relying on password_verify() for Blowfish hashes are less likely exposed.
Exploitation context
Sources do not show CISA KEV listing or confirmed active exploitation. Practical impact depends on an invalid Blowfish hash being present in the password database. If present for an account, authentication for that entry may incorrectly succeed with any password.
Researcher notes
The core condition is data-dependent: password_verify() accepts some invalid Blowfish hashes. Assess reachable authentication paths, hash formats, and migration/import processes. NetApp published a downstream advisory, so validate third-party products separately rather than assuming only custom PHP apps are relevant.
Mitigation direction
- Upgrade PHP to 8.0.28, 8.1.16, 8.2.3, or later supported releases.
- Review vendor guidance for appliances or bundled products that include PHP.
- Audit password stores for invalid Blowfish/bcrypt hashes where feasible.
- Reset credentials for accounts found with invalid or malformed password hashes.
- Prioritize internet-facing or high-privilege authentication systems first.
Validation and detection
- Inventory production PHP versions and compare against affected ranges.
- Identify applications using password_verify() for Blowfish or bcrypt password hashes.
- Confirm patched PHP runtimes are deployed across web, worker, and CLI environments.
- Review authentication logs for unusual successful logins on affected systems.
- Document any invalid hash findings and associated account remediation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-916: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2023-0567 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N2.85.2CISA-ADPCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N2.55.2phpVulnerability scoring details
Base CVSS 3.1 score
8.1HighVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Base CVSS 3.1 score
7.7HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://bugs.php.net/bug.php?id=81744CVE reference, php
- https://github.com/php/php-src/security/advisories/GHSA-7fj2-8x79-rjf4CVE reference, php
- https://security.netapp.com/advisory/ntap-20230331-0008/CVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use of Password Hash With Insufficient Computational Effort
Use of Password Hash With Insufficient Computational Effort represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.