This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] PHP fixes 3 critical vulnerabilities
PHP is fixing 3 critical vulnerabilities in versions 8.3.8, 8.2.20 and 8.1.29 [1]; among operating systems, only Slackware has fixed them so far [2].
An unauthenticated remote attacker can execute arbitrary commands in the operating system (Windows) of the affected device in PHP CGI using specially crafted URLs [1]. Whether a machine is vulnerable can be verified using a script that can be found at [3]. The vulnerability is being actively exploited [4].
The vulnerability is present in product:
- php;>=8.1,<8.1.29;>=8.2,<8.2.20;>=8.3,<8.3.8
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-4577 at cve.org, NVD
- CWE-78 at cwe.mitre.org
The vulnerability was publicly disclosed 6. 6. 2024. This report was last updated 15. 7. 2024.
An unauthenticated remote attacker can execute arbitrary commands in the Windows shell of the affected device [1].
The vulnerability is present in products:
- php;>=8.1,<8.1.29;>=8.2,<8.2.20;>=8.3,<8.3.8
- debian:php;>=8.2,<8.2.20-1~deb12u1;>7.4,<7.4.33-1+deb11u5;>=8.2.21,<8.2.21-1
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-5585 at cve.org, NVD
- CWE-78 at cwe.mitre.org
The vulnerability was publicly disclosed 6. 6. 2024.
An unauthenticated remote attacker can bypass the PHP Filter, which may lead to various attacks on websites, such as XSS or SQL injection [1].
The vulnerability is present in product:
- php;>=8.1,<8.1.29;>=8.2,<8.2.20;>=8.3,<8.3.8
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
More information:
- CVE-2024-5458 at cve.org, NVD
- CWE-385 at cwe.mitre.org
The vulnerability was publicly disclosed 6. 6. 2024.
Links
By CESNET, z.s.p.o. Martin Krajči on 7. 6. 2024.