PT-2024-16833 · Easyphp · Easyphp

Rafael Pedrero · Published 2024-11-14 · Updated 2026-01-07 · CVE-2024-11215

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions EasyPHP version 14.1

Description The issue is an absolute path traversal vulnerability, which could allow remote users to bypass SecurityManager restrictions and retrieve any file stored on the server. This is achieved by setting consecutive strings ‘/...%5c’. The vulnerability may potentially lead to remote code execution.

Recommendations For EasyPHP version 14.1, patch immediately to resolve the issue and review logs for signs of compromise. As a temporary workaround, consider restricting access to sensitive files and directories to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-11215

Affected Products

Easyphp

References · 9

• https://osv.dev/vulnerability/CVE-2024-11215 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-11215 · Security Note
• https://twitter.com/oktsec/status/1857100746866511974 · Twitter Post
• https://t.me/cvedetector/10952 · Telegram Post
• https://t.me/cveNotify/147979 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1857123088741072970 · Twitter Post
• https://incibe.es/en/incibe-cert/notices/aviso/path-traversal-vulnerability-easyphp · Note
• https://twitter.com/CVEnew/status/1857064957407338497 · Twitter Post
• https://twitter.com/incibe_cert/status/1856994405510504904 · Twitter Post