The vulnerability in openssl_encrypt before version 1.4.0 allows an attacker to trigger database errors that are returned in full by the /ready endpoint. These exception strings can reveal hostnames, IP addresses, connection parameters and may contain credentials, thereby compromising the confidentiality of the system. The weakness falls under CWE‑209 – Improper Handling of Error Messages or Data Out‑of‑Band Leakage.

Vendor "jahlives" offers the openssl_encrypt product. All releases before 1.4.0 are affected; no other vendors or product variants are listed as impacted.

Scored with CVSS 8.7, indicating a high severity of confidentiality loss. The EPSS score is not available and the vulnerability is not listed in CISA KEV, suggesting no known widespread exploitation yet, but the lack of authentication requirements means any unauthenticated requester could invoke the endpoint and provoke an error. The attack path is straightforward: issue HTTP requests to /ready, induce a database exception, and capture the returned payload. The possibility of extracting credentials elevates the risk even if exploitation may require triggering specific errors.