CVE-2024-1874 (GCVE-0-2024-1874)

Vulnerability from cvelistv5 – Published: 2024-04-29 03:57 – Updated: 2025-11-04 18:22

Title

Command injection via array-ish $command parameter of proc_open()

Summary

In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.

Severity

9.4 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-04-29 13:05 UTC

CWE

CWE-116 - Improper Encoding or Escaping of Output

Assigner

php mitre root

References

10 references

URL	Tags
https://github.com/php/php-src/security/advisorie…
http://www.openwall.com/lists/oss-security/2024/0…
https://security.netapp.com/advisory/ntap-2024051…
http://www.openwall.com/lists/oss-security/2024/06/07/1
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://www.vicarius.io/vsociety/posts/command-in…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://www.kb.cert.org/vuls/id/123335

Impacted products

4 products

Vendor	Product	Version	CPE status
PHP Group	PHP	Affected: 8.1.* , < 8.1.28 (semver) Affected: 8.2.* , < 8.2.18 (semver) Affected: 8.3.* , < 8.3.5 (semver)	guessed
php_group	php	Affected: 8.1.0 cpe:2.3:a:php_group:php:8.1.0:::::::*
php_group	php	Affected: 8.2.0 cpe:2.3:a:php_group:php:8.2.0:::::::*
php_group	php	Affected: 8.3.0 cpe:2.3:a:php_group:php:8.3.0:::::::*

Date Public

2024-04-11 17:15

Credits

RyotaK

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:php_group:php:8.1.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "php",
            "vendor": "php_group",
            "versions": [
              {
                "status": "affected",
                "version": "8.1.0"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:php_group:php:8.2.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "php",
            "vendor": "php_group",
            "versions": [
              {
                "status": "affected",
                "version": "8.2.0"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:php_group:php:8.3.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "php",
            "vendor": "php_group",
            "versions": [
              {
                "status": "affected",
                "version": "8.3.0"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-1874",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-29T13:05:18.510843Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T18:00:58.913Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T18:22:36.621Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/php/php-src/security/advisories/GHSA-pc52-254m-w9w7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/04/12/11"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240510-0009/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/06/07/1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/"
          },
          {
            "url": "https://www.vicarius.io/vsociety/posts/command-injection-vulnerability-in-php-on-windows-systems-cve-2024-1874-and-cve-2024-5585"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZGWIK3HMBACERGB4TSBB2JUOMPYY2VKY/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJZK3X6B7FBE32FETDSMRLJXTFTHKWSY/"
          },
          {
            "url": "https://www.kb.cert.org/vuls/id/123335"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "platforms": [
            "Windows"
          ],
          "product": "PHP",
          "vendor": "PHP Group",
          "versions": [
            {
              "lessThan": "8.1.28",
              "status": "affected",
              "version": "8.1.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.2.18",
              "status": "affected",
              "version": "8.2.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.3.5",
              "status": "affected",
              "version": "8.3.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "This problem only present in Windows versions of PHP.\u0026nbsp;"
            }
          ],
          "value": "This problem only present in Windows versions of PHP."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "RyotaK"
        }
      ],
      "datePublic": "2024-04-11T17:15:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.\u0026nbsp;\u003c/p\u003e"
            }
          ],
          "value": "In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-116",
              "description": "CWE-116 Improper Encoding or Escaping of Output",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-13T04:06:17.168Z",
        "orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
        "shortName": "php"
      },
      "references": [
        {
          "url": "https://github.com/php/php-src/security/advisories/GHSA-pc52-254m-w9w7"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2024/04/12/11"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240510-0009/"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2024/06/07/1"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/"
        }
      ],
      "source": {
        "advisory": "https://github.com/php/php-src/security/advisories/GHSA-pc52-254",
        "discovery": "EXTERNAL"
      },
      "title": "Command injection via array-ish $command parameter of proc_open()",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Using proc_open() string syntax avoids the problem.\u0026nbsp;"
            }
          ],
          "value": "Using proc_open() string syntax avoids the problem."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
    "assignerShortName": "php",
    "cveId": "CVE-2024-1874",
    "datePublished": "2024-04-29T03:57:35.624Z",
    "dateReserved": "2024-02-25T04:39:00.479Z",
    "dateUpdated": "2025-11-04T18:22:36.621Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-1874",
      "date": "2026-09-19",
      "epss": "0.32568",
      "percentile": "0.98261"
    },
    "fkie_nvd": {
      "descriptions": [
        {
          "lang": "en",
          "value": "In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.\u00a0\n\n"
        },
        {
          "lang": "es",
          "value": "En las versiones de PHP 8.1.* anteriores a 8.1.28, 8.2.* anteriores a 8.2.18, 8.3.* anteriores a 8.3.5, cuando se utiliza el comando proc_open() con sintaxis de matriz, debido a un escape insuficiente, si los argumentos del comando ejecutado son controlado por un usuario malintencionado, el usuario puede proporcionar argumentos que ejecutar\u00edan comandos arbitrarios en el shell de Windows."
        }
      ],
      "id": "CVE-2024-1874",
      "lastModified": "2024-11-21T08:51:29.893",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 9.4,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
              "version": "3.1"
            },
            "exploitabilityScore": 3.9,
            "impactScore": 5.5,
            "source": "security@php.net",
            "type": "Secondary"
          }
        ]
      },
      "published": "2024-04-29T04:15:07.580",
      "references": [
        {
          "source": "security@php.net",
          "url": "http://www.openwall.com/lists/oss-security/2024/04/12/11"
        },
        {
          "source": "security@php.net",
          "url": "http://www.openwall.com/lists/oss-security/2024/06/07/1"
        },
        {
          "source": "security@php.net",
          "url": "https://github.com/php/php-src/security/advisories/GHSA-pc52-254m-w9w7"
        },
        {
          "source": "security@php.net",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/"
        },
        {
          "source": "security@php.net",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/"
        },
        {
          "source": "security@php.net",
          "url": "https://security.netapp.com/advisory/ntap-20240510-0009/"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://www.openwall.com/lists/oss-security/2024/04/12/11"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://www.openwall.com/lists/oss-security/2024/06/07/1"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://github.com/php/php-src/security/advisories/GHSA-pc52-254m-w9w7"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://security.netapp.com/advisory/ntap-20240510-0009/"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://www.vicarius.io/vsociety/posts/command-injection-vulnerability-in-php-on-windows-systems-cve-2024-1874-and-cve-2024-5585"
        }
      ],
      "sourceIdentifier": "security@php.net",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-116"
            }
          ],
          "source": "security@php.net",
          "type": "Secondary"
        }
      ]
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T02:49:02.000Z",
      "cve": "CVE-2024-1874",
      "id": "msrc_CVE-2024-1874",
      "initial_release_date": "2024-04-02T07:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Command injection via array-ish $command parameter of proc_open()",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-1874.json",
      "version": "3"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "affected",
                "platforms": [
                  "Windows"
                ],
                "product": "PHP",
                "vendor": "PHP Group",
                "versions": [
                  {
                    "lessThan": "8.1.28",
                    "status": "affected",
                    "version": "8.1.*",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "8.2.18",
                    "status": "affected",
                    "version": "8.2.*",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "8.3.5",
                    "status": "affected",
                    "version": "8.3.*",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "security@php.net"
          },
          {
            "affectedData": [
              {
                "cpes": [
                  "cpe:2.3:a:php_group:php:8.1.0:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "php",
                "vendor": "php_group",
                "versions": [
                  {
                    "status": "affected",
                    "version": "8.1.0"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:php_group:php:8.2.0:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "php",
                "vendor": "php_group",
                "versions": [
                  {
                    "status": "affected",
                    "version": "8.2.0"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:php_group:php:8.3.0:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "php",
                "vendor": "php_group",
                "versions": [
                  {
                    "status": "affected",
                    "version": "8.3.0"
                  }
                ]
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A888D1BE-9D93-4707-AA45-61EF1DB5488C",
                    "versionEndExcluding": "8.1.28",
                    "versionStartIncluding": "8.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6AC1B000-D5C4-49E9-8EFE-8C5C8FF50AF2",
                    "versionEndExcluding": "8.2.18",
                    "versionStartIncluding": "8.2.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BE619987-797E-493B-B089-2E1CADDA9C47",
                    "versionEndExcluding": "8.3.5",
                    "versionStartIncluding": "8.3.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B8EDB836-4E6A-4B71-B9B2-AA3E03E0F646",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CA277A6C-83EC-4536-9125-97B84C4FAF59",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell."
          },
          {
            "lang": "es",
            "value": "En las versiones de PHP 8.1.* anteriores a 8.1.28, 8.2.* anteriores a 8.2.18, 8.3.* anteriores a 8.3.5, cuando se utiliza el comando proc_open() con sintaxis de matriz, debido a un escape insuficiente, si los argumentos del comando ejecutado son controlado por un usuario malintencionado, el usuario puede proporcionar argumentos que ejecutar\u00edan comandos arbitrarios en el shell de Windows."
          }
        ],
        "id": "CVE-2024-1874",
        "lastModified": "2026-06-17T07:05:11.613",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 9.4,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.5,
              "source": "security@php.net",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-1874",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-29T13:05:18.510843Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-04-29T04:15:07.580",
        "references": [
          {
            "source": "security@php.net",
            "tags": [
              "Mailing List"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/04/12/11"
          },
          {
            "source": "security@php.net",
            "tags": [
              "Mailing List"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/06/07/1"
          },
          {
            "source": "security@php.net",
            "tags": [
              "Exploit",
              "Vendor Advisory"
            ],
            "url": "https://github.com/php/php-src/security/advisories/GHSA-pc52-254m-w9w7"
          },
          {
            "source": "security@php.net",
            "tags": [
              "Mailing List"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/"
          },
          {
            "source": "security@php.net",
            "tags": [
              "Mailing List"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/"
          },
          {
            "source": "security@php.net",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240510-0009/"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/04/12/11"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/06/07/1"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Exploit",
              "Vendor Advisory"
            ],
            "url": "https://github.com/php/php-src/security/advisories/GHSA-pc52-254m-w9w7"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJZK3X6B7FBE32FETDSMRLJXTFTHKWSY/"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZGWIK3HMBACERGB4TSBB2JUOMPYY2VKY/"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240510-0009/"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://www.kb.cert.org/vuls/id/123335"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Exploit",
              "Third Party Advisory"
            ],
            "url": "https://www.vicarius.io/vsociety/posts/command-injection-vulnerability-in-php-on-windows-systems-cve-2024-1874-and-cve-2024-5585"
          }
        ],
        "sourceIdentifier": "security@php.net",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-116"
              }
            ],
            "source": "security@php.net",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2025-11-21T14:50:24+00:00",
      "cve": "CVE-2024-1874",
      "id": "CVE-2024-1874",
      "initial_release_date": "2024-04-09T00:00:00+00:00",
      "product_status:known_affected": "54",
      "product_status:known_not_affected": "219",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "php: Fail to Escape Arguments Properly in Microsoft Windows",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-1874.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "critical",
      "current_release_date": "2026-09-03T00:28:33Z",
      "cve": "CVE-2024-1874",
      "id": "CVE-2024-1874",
      "initial_release_date": "2025-02-14T05:50:45Z",
      "product_status:known_not_affected": "4690",
      "product_status:recommended": "206",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-1874",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-1874.json",
      "version": "19"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2025-11-04T17:14:11.693Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://github.com/php/php-src/security/advisories/GHSA-pc52-254m-w9w7"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "http://www.openwall.com/lists/oss-security/2024/04/12/11"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://security.netapp.com/advisory/ntap-20240510-0009/"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "http://www.openwall.com/lists/oss-security/2024/06/07/1"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/"
              },
              {
                "url": "https://www.vicarius.io/vsociety/posts/command-injection-vulnerability-in-php-on-windows-systems-cve-2024-1874-and-cve-2024-5585"
              },
              {
                "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZGWIK3HMBACERGB4TSBB2JUOMPYY2VKY/"
              },
              {
                "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJZK3X6B7FBE32FETDSMRLJXTFTHKWSY/"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "affected": [
              {
                "cpes": [
                  "cpe:2.3:a:php_group:php:8.1.0:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "php",
                "vendor": "php_group",
                "versions": [
                  {
                    "status": "affected",
                    "version": "8.1.0"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:php_group:php:8.2.0:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "php",
                "vendor": "php_group",
                "versions": [
                  {
                    "status": "affected",
                    "version": "8.2.0"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:php_group:php:8.3.0:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "php",
                "vendor": "php_group",
                "versions": [
                  {
                    "status": "affected",
                    "version": "8.3.0"
                  }
                ]
              }
            ],
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-1874",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-04-29T13:05:18.510843Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-04-29T13:09:16.021Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "affected",
              "platforms": [
                "Windows"
              ],
              "product": "PHP",
              "vendor": "PHP Group",
              "versions": [
                {
                  "lessThan": "8.1.28",
                  "status": "affected",
                  "version": "8.1.*",
                  "versionType": "semver"
                },
                {
                  "lessThan": "8.2.18",
                  "status": "affected",
                  "version": "8.2.*",
                  "versionType": "semver"
                },
                {
                  "lessThan": "8.3.5",
                  "status": "affected",
                  "version": "8.3.*",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "configurations": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "This problem only present in Windows versions of PHP.\u0026nbsp;"
                }
              ],
              "value": "This problem only present in Windows versions of PHP."
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "reporter",
              "value": "RyotaK"
            }
          ],
          "datePublic": "2024-04-11T17:15:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eIn PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.\u0026nbsp;\u003c/p\u003e"
                }
              ],
              "value": "In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 9.4,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-116",
                  "description": "CWE-116 Improper Encoding or Escaping of Output",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2024-06-13T04:06:17.168Z",
            "orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
            "shortName": "php"
          },
          "references": [
            {
              "url": "https://github.com/php/php-src/security/advisories/GHSA-pc52-254m-w9w7"
            },
            {
              "url": "http://www.openwall.com/lists/oss-security/2024/04/12/11"
            },
            {
              "url": "https://security.netapp.com/advisory/ntap-20240510-0009/"
            },
            {
              "url": "http://www.openwall.com/lists/oss-security/2024/06/07/1"
            },
            {
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/"
            },
            {
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/"
            }
          ],
          "source": {
            "advisory": "https://github.com/php/php-src/security/advisories/GHSA-pc52-254",
            "discovery": "EXTERNAL"
          },
          "title": "Command injection via array-ish $command parameter of proc_open()",
          "workarounds": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Using proc_open() string syntax avoids the problem.\u0026nbsp;"
                }
              ],
              "value": "Using proc_open() string syntax avoids the problem."
            }
          ],
          "x_generator": {
            "engine": "Vulnogram 0.1.0-dev"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
        "assignerShortName": "php",
        "cveId": "CVE-2024-1874",
        "datePublished": "2024-04-29T03:57:35.624Z",
        "dateReserved": "2024-02-25T04:39:00.479Z",
        "dateUpdated": "2025-11-04T17:14:11.693Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

HSEC-2024-0003 (CVE-2024-3566)

Vulnerability from osv_haskell – Published: 2025-11-14 14:45 – Updated: 2025-11-14 14:45 – Source website

Summary

process: command injection via argument list on Windows

Details

process: command injection via argument list on Windows

The process library on Windows is vulnerable to a command injection vulnerability, via cmd.exe's interpretation of arguments. Programs that invoke batch files (.bat, .cmd) and pass arguments whose values are affected by program inputs may be affected.

This issue was discovered in many programming languages' Windows process execution behaviour. It was tracked by CERT/CC as VU#123335 and a coordinated disclosure was made on 2024-04-09 17:00 UTC.

A fix was released in process-1.6.19.0.

Background

Unlike POSIX systems, Windows does not have a mechanism for passing multiple arguments.Command line parsing is up to individual programs.

The process library defines the RawCommand constructor for specifying an executable and its arguments:

data CmdSpec
  = ShellCommand String
  | RawCommand FilePath [String]

On Windows, the RawCommand executable name and arguments are serialised into a single command line string, with separate arguments quoted separately. process then invokes the Windows CreateProcess routine with this command line string is given as the lpCommandLine argument.

Issue

When executing .bat or .cmd files, CreateProcess implicitly spawns cmd.exe. The System.Process command line construction does not escape characters with special meaning to cmd.exe. As a consequence, a command injection vulnerability arises when the following conditions are satisfied:

Program running on Windows
Program executes a .bat or .cmd file
The argument values include or are influenced by program input

Demonstration

The following batch file, test.bat, merely prints the executable name the first two arguments (as interpreted by cmd.exe):

@ECHO OFF
ECHO 0: %0
ECHO 1: %1
ECHO 2: %2
PAUSE

The following Haskell program executes test.bat with basic string arguments. The output is as expected:

λ> readProcess "test.bat" ["a","b"] [] >>= putStrLn
0: "test.bat"
1: "a"
2: "b"

However, we can use a close quote and the & character to induce cmd.exe to execute a program named in the argument:

λ> readProcess "test.bat" ["\"&calc.exe"] [] >>= putStrLn
0: "test.bat"
1: "\"
2:

In addition to producing the above output, calc.exe is executed.

Mitigation

The lack of a general mechanism on Windows for safely conveying command line arguments to programs increases the risk of this kind of security issue. The fact that cmd.exe command line parsing is complex and poorly documented exacerbates this issue, and also heightens the risk that the fix is incomplete, or causes other issues.

If possible, avoid executing batch files where arguments include or are influenced by untrusted program inputs. If it must be done, reject arguments that include special characters including & and ".

Fix versions

process was modified to perform additional escaping and quoting when executing .bat and .cmd files on Windows (ignoring character case). The behaviour is unchanged in all other cases.

The fix was released in process-1.6.19.0. The following GHC releases were the first in their series to include a fixed version of the process library:

GHC 9.10.1-alpha3 (released 2024-04-15)
GHC 9.8.3 (released 2024-10-20)
GHC 9.6.5 (released 2024-04-16)

Such a change in semantics should normally result in a major version bump. Because we expect very few (if any) users will be impacted by the behavioural change, the GHC team made a pragmatic decision to avoid the disruption that a major version bump would cause.

A follow-up fix was released in process-1.6.23.0 to handle batch scripts with paths ending in whitespace and periods and unescaped % expansions.

Acknowledgements

Security researcher RyotaK discovered and responsibly disclosed this vulnerability, coordinating the response across the many affected langauges and ecosystems.

Ben Gamari commited and released the fix, which was based on a proposal by Fraser Tweedale. Fraser also improved the System.Process module documentation to better explain the Windows semantics.

Security researcher Kainan Zhang (@4xpl0r3r) discovered and responsibly disclosing the issue in the first fix and the Rust Security Response WG coordinated the response.

References

URL

Type

	https://flatt.tech/research/posts/batbadbut-you-c…	ARTICLE
	https://kb.cert.org/vuls/id/123335	ADVISORY
	https://github.com/haskell/process/commit/3c419f9…	FIX
	https://github.com/haskell/process/commit/951b02d…	FIX
	https://github.com/haskell/process/commit/5fc91f5…	FIX

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "human_link": "https://github.com/haskell/security-advisories/tree/main/advisories/published/2024/HSEC-2024-0003.md",
        "osv": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export/2024/HSEC-2024-0003.json"
      },
      "package": {
        "ecosystem": "Hackage",
        "name": "process"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.0.0.0"
            },
            {
              "fixed": "1.6.23.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": [
        {
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "type": "CVSS_V3"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-3566"
  ],
  "database_specific": {
    "home": "https://github.com/haskell/security-advisories",
    "osvs": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export",
    "repository": "https://github.com/haskell/security-advisories"
  },
  "details": "# process: command injection via argument list on Windows\n\nThe *process* library on Windows is vulnerable to a command injection\nvulnerability, via `cmd.exe`\u0027s interpretation of arguments.  Programs that\ninvoke batch files (`.bat`, `.cmd`) and pass arguments whose values are\naffected by program inputs may be affected.\n\nThis issue was discovered in many programming languages\u0027 Windows process\nexecution behaviour.  It was tracked by CERT/CC as **VU#123335** and a\ncoordinated disclosure was made on 2024-04-09 17:00 UTC.\n\nA fix was released in *process-1.6.19.0*.\n\n\n## Background\n\nUnlike POSIX systems, Windows does not have a mechanism for passing multiple\narguments.Command line parsing is up to individual programs.\n\nThe *process* library defines the `RawCommand` constructor for specifying an\nexecutable and its arguments:\n\n```haskell\ndata CmdSpec\n  = ShellCommand String\n  | RawCommand FilePath [String]\n```\n\nOn Windows, the `RawCommand` executable name and arguments are serialised into\na single *command line* string, with separate arguments quoted separately.\n*process* then invokes the Windows [`CreateProcess`][doc-CreateProcess]\nroutine with this command line string is given as the `lpCommandLine`\nargument.\n\n[doc-CreateProcess]: https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessa\n\n\n## Issue\n\nWhen executing `.bat` or `.cmd` files, [`CreateProcess`][doc-CreateProcess]\nimplicitly spawns `cmd.exe`.  The `System.Process` command line construction\ndoes not escape characters with special meaning to `cmd.exe`.  As a\nconsequence, a command injection vulnerability arises when the following\nconditions are satisfied:\n\n- Program running on Windows\n- Program executes a `.bat` or `.cmd` file\n- The argument values include or are influenced by program input\n\n\n## Demonstration\n\nThe following batch file, `test.bat`, merely prints the executable name the\nfirst two arguments (as interpreted by `cmd.exe`):\n\n```\n@ECHO OFF\nECHO 0: %0\nECHO 1: %1\nECHO 2: %2\nPAUSE\n```\n\nThe following Haskell program executes `test.bat` with basic string arguments.\nThe output is as expected:\n\n```\n\u03bb\u003e readProcess \"test.bat\" [\"a\",\"b\"] [] \u003e\u003e= putStrLn\n0: \"test.bat\"\n1: \"a\"\n2: \"b\"\n```\n\nHowever, we can use a close quote and the `\u0026` character to induce `cmd.exe` to\nexecute a program named in the argument:\n\n```\n\u03bb\u003e readProcess \"test.bat\" [\"\\\"\u0026calc.exe\"] [] \u003e\u003e= putStrLn\n0: \"test.bat\"\n1: \"\\\"\n2:\n```\n\nIn addition to producing the above output, `calc.exe` is executed.\n\n\n## Mitigation\n\nThe lack of a general mechanism on Windows for safely conveying command line\narguments to programs increases the risk of this kind of security issue.  The\nfact that `cmd.exe` command line parsing is complex and poorly documented\nexacerbates this issue, and also heightens the risk that the fix is\nincomplete, or causes other issues.\n\nIf possible, avoid executing batch files where arguments include or are\ninfluenced by untrusted program inputs.  If it must be done, reject arguments\nthat include special characters including `\u0026` and `\"`.\n\n\n## Fix versions\n\n*process* was modified to perform additional escaping and quoting\nwhen executing `.bat` and `.cmd` files on Windows (ignoring\ncharacter case).  The behaviour is unchanged in all other cases.\n\nThe fix was released in ***process-1.6.19.0***.  The following GHC\nreleases were the first in their series to include a fixed version\nof the *process* library:\n\n- **GHC 9.10.1-alpha3** (released 2024-04-15)\n- **GHC 9.8.3** (released 2024-10-20)\n- **GHC 9.6.5** (released 2024-04-16)\n\nSuch a change in semantics should normally result in a major version\nbump.  Because we expect very few (if any) users will be impacted by\nthe behavioural change, the GHC team made a pragmatic decision to\navoid the disruption that a major version bump would cause.\n\nA follow-up fix was released in ***process-1.6.23.0*** to handle batch\nscripts with paths ending in whitespace and periods and\nunescaped `%` expansions.\n\n\n## Acknowledgements\n\nSecurity researcher **RyotaK** discovered and responsibly disclosed\nthis vulnerability, coordinating the response across the many\naffected langauges and ecosystems.\n\nBen Gamari commited and released the fix, which was based on a\nproposal by Fraser Tweedale.  Fraser also improved the\n`System.Process` module documentation to better explain the Windows\nsemantics.\n\nSecurity researcher **Kainan Zhang** (@4xpl0r3r) discovered and\nresponsibly disclosing the issue in the first fix and the Rust\nSecurity Response WG coordinated the response.\n",
  "id": "HSEC-2024-0003",
  "modified": "2025-11-14T14:45:34Z",
  "published": "2025-11-14T14:45:34Z",
  "references": [
    {
      "type": "ARTICLE",
      "url": "https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/"
    },
    {
      "type": "ADVISORY",
      "url": "https://kb.cert.org/vuls/id/123335"
    },
    {
      "type": "FIX",
      "url": "https://github.com/haskell/process/commit/3c419f9eeedac024c9dccce544e5a6fb587179a5"
    },
    {
      "type": "FIX",
      "url": "https://github.com/haskell/process/commit/951b02dd95559b1a26f2456bfb97cf740ea40934"
    },
    {
      "type": "FIX",
      "url": "https://github.com/haskell/process/commit/5fc91f5f36ed4479be2b95f04f264bb78ac8089d"
    }
  ],
  "related": [
    "CVE-2024-1874",
    "CVE-2024-24576",
    "CVE-2024-22423"
  ],
  "schema_version": "1.5.0",
  "summary": "process: command injection via argument list on Windows"
}

MSRC_CVE-2024-1874

Vulnerability from csaf_microsoft - Published: 2024-04-02 07:00 - Updated: 2026-02-18 02:49

Summary

Command injection via array-ish $command parameter of proc_open()

Scope

1 vulnerability in this advisory, including CVE-2024-1874.

CVE-2024-1874

9.4 (Critical)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Fixed: 2 products Known affected: 2 products Known not affected: 1 product

https://learn.microsoft.com/en-us/azure/azure-linux/tutoria…

Open the full advisory

NCSC-2024-0243

Vulnerability from csaf_ncscnl - Published: 2024-06-10 07:02 - Updated: 2024-06-10 07:02

Summary

Kwetsbaarheden verholpen in PHP

Scope

4 vulnerabilities in this advisory, including CVE-2024-1874.

CVE-2024-1874

9.4 (Critical)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Known affected: 3 products

Open the full advisory

NCSC-2024-0411

Vulnerability from csaf_ncscnl - Published: 2024-10-17 13:15 - Updated: 2024-10-17 13:15

Summary

Kwetsbaarheden verholpen in Oracle Database producten

Scope

104 vulnerabilities in this advisory, including CVE-2024-1874.

CVE-2024-1874

9.8 (Critical)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Known affected: 3 products

Open the full advisory

OPENSUSE-SU-2024:13867-1

Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2024-06-15 00:00

Summary

php8-8.3.6-1.1 on GA media

Severity

Moderate

Scope

4 vulnerabilities in this advisory, including CVE-2024-1874.

CVE-2024-1874

Recommended: 192 products

Open the full advisory

WID-SEC-W-2024-0867

Vulnerability from csaf_certbund - Published: 2024-04-11 22:00 - Updated: 2025-05-12 22:00

Summary

PHP: Mehrere Schwachstellen

Severity

Hoch

Scope

4 vulnerabilities in this advisory, including CVE-2024-1874.

CVE-2024-1874

Known affected: 13 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2024-1874 (GCVE-0-2024-1874)

HSEC-2024-0003 (CVE-2024-3566)

process: command injection via argument list on Windows

Background

Issue

Demonstration

Mitigation

Fix versions

Acknowledgements

MSRC_CVE-2024-1874

NCSC-2024-0243

NCSC-2024-0411

OPENSUSE-SU-2024:13867-1

WID-SEC-W-2024-0867

Tags

Sightings

Nomenclature

Related by attack behaviour