PT-2021-21823 · Unknown · Phpfastcache

Jhhua · Published 2021-08-12 · Updated 2022-10-27 · CVE-2021-37704

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions PhpFastCache versions prior to 6.1.5 PhpFastCache versions prior to 7.1.2 PhpFastCache versions prior to 8.0.7

Description The issue concerns the exposure of phpinfo() when the /vendor directory is not protected from public access. This situation is rare today, as the vendor directory is often located outside the web directory or protected via server rules.

Recommendations For versions prior to 6.1.5, update to version 6.1.5 or later. For versions prior to 7.1.2, update to version 7.1.2 or later. For versions prior to 8.0.7, update to version 8.0.7 or later. As a temporary workaround, protect the /vendor directory from public access.

Exploit

Fix

Information Disclosure

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-200

CWE-668

Related Identifiers

CVE-2021-37704

GHSA-CVH5-P6R6-G2QC

Affected Products

Phpfastcache

References · 12

• 🔥 https://github.com/flextype/flextype/issues/567 · Exploit
• https://github.com/PHPSocialNetwork/phpfastcache/commit/41a77d0d8f126dbd6fbedcd9e6a82e86cdaafa51 · Patch
• https://github.com/PHPSocialNetwork/phpfastcache/pull/813 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-37704 · Security Note
• https://osv.dev/vulnerability/GHSA-cvh5-p6r6-g2qc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-37704 · Vendor Advisory
• https://github.com/PHPSocialNetwork/phpfastcache/pull/814 · Note
• https://github.com/PHPSocialNetwork/phpfastcache/security/advisories/GHSA-cvh5-p6r6-g2qc · Note
• https://github.com/PHPSocialNetwork/phpfastcache/blob/master/CHANGELOG.md#807 · Note
• https://github.com/PHPSocialNetwork/phpfastcache/pull/815 · Note
• https://t.me/cibsecurity/27275 · Telegram Post
• https://packagist.org/packages/phpfastcache/phpfastcache · Note