CVE-2024-1874

2024-04-2900:00:00

ubuntu.com

command injection

proc_open

array-ish parameter

windows

debian

pear

php

CVSS3

9.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

AI Score

9.6

Confidence

High

EPSS

Percentile

10.3%

JSON

In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before
8.3.5, when using proc_open() command with array syntax, due to
insufficient escaping, if the arguments of the executed command are
controlled by a malicious user, the user can supply arguments that would
execute arbitrary commands in Windows shell.

Notes

Author	Note
leosilva	from debian “Only affects improper handling of command line arguments on Windows”
sbeattie	PEAR issues should go against php-pear as of xenial