CVE-2024-1874

Katalog CVE

CVSS 9.4 · Critical EPSS 32,6%

Kerentanan Improper Encoding or Escaping of Output pada php, fedoraproject fedora. Skor CVSS 3.1 9.4 (Critical) menurut php.net.

Deskripsi (NVD)

In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.

Rincian

Terbit di NVD

29 April 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.4 (Critical), sumber php.net
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-116: Improper Encoding or Escaping of Output

EPSS (30 hari)

32,6% peluang dieksploitasi; lebih tinggi dari 98,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/php/php-src/security/advisories/GHSA-pc52-254m-w9w7 exploit · advisory vendor
• https://security.netapp.com/advisory/ntap-20240510-0009/ advisory pihak ketiga
• https://www.vicarius.io/vsociety/posts/command-injection-vulnerability-in-php-on-windows-systems-cve-2024-1874... exploit · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2024/04/12/11 mailing list
• http://www.openwall.com/lists/oss-security/2024/06/07/1 mailing list
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RX... mailing list
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTO... mailing list
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJZK3X6B7FBE32F...
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZGWIK3HMBACERGB...
• https://www.kb.cert.org/vuls/id/123335