PT-2024-9898 · Craft Cms · Craft Cms
Akues-An
·
Published
2024-11-19
·
Updated
2026-01-04
·
CVE-2024-56145
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Craft CMS versions 3.9.14, 4.13.2, and 5.5.2
Description
Craft CMS is susceptible to a remote code execution issue. This affects users whose php.ini configuration has
register argc argv enabled. An unspecified remote code execution vector is present for these users. Approximately 150,000 sites created with Craft CMS are estimated to be affected. The vulnerability allows an attacker to pass code in place of CLI arguments, potentially gaining remote code execution. Exploitation has been demonstrated publicly, and a proof-of-concept (PoC) exploit is available.Recommendations
Update to version 3.9.14.
Update to version 4.13.2.
Update to version 5.5.2.
If an upgrade is not possible, disable the
register argc argv setting in your php.ini configuration to mitigate the issue.Exploit
Fix
RCE
Code Injection
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Craft Cms