5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
6.5 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
45.5%
microsoft/microsoft-graph is vulnerable to Information Disclosure. The vulnerability exists in the phpinfo
function of GetPhpInfo.php
, allowing an attacker to access unauthorized system information such as configuration details, modules, and environment variables. This vulnerability is only exploitable if the applications /vendor
directory is web accessible.
github.com/microsoftgraph/msgraph-beta-sdk-php/compare/2.0.0...2.0.1
github.com/microsoftgraph/msgraph-sdk-php-core/compare/2.0.1...2.0.2
github.com/microsoftgraph/msgraph-sdk-php/commit/68c24949ba29097e53ae17f8cf5f121de0e48134
github.com/microsoftgraph/msgraph-sdk-php/compare/1.109.0...1.109.1
github.com/microsoftgraph/msgraph-sdk-php/security/advisories/GHSA-cgwq-6prq-8h9q
owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/
5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
6.5 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
45.5%