CVE-2021-37704GHSA-CVH5-P6R6-G2QC
Exposed phpinfo() in PhpFastCache
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.1.5, 7.1.2, 8.0.7
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 Nuclei template
Summary
PhpFastCache is a high-performance backend cache system (packagist package phpfastcache/phpfastcache). In versions before 6.1.5, 7.1.2, and 8.0.7 the `phpinfo()` can be exposed if the `/vendor` is not protected from public access. This is a rare situation today since the vendor directory is often located outside the web directory or protected via server rule (.htaccess, etc). Only the v6, v7 and v8 will be patched respectively in 8.0.7, 7.1.2, 6.1.5. Older versions such as v5, v4 are not longer supported and will NOT be patched. As a workaround, protect the `/vendor` directory from public access.
Timeline
- CVE published
- Record last updated
Affected versions
- PHPSocialNetwork phpfastcache
fixed in 6.1.5; From 7.0.0 · fixed in 7.1.2; From 8.0.0 · fixed in 8.0.7
- phpfastcache/phpfastcachePackagist
fixed in 6.1.5
- phpfastcache/phpfastcachePackagist
From 7.0.0 · fixed in 7.1.2
- phpfastcache/phpfastcachePackagist
From 8.0.0 · fixed in 8.0.7