Skip to content
OpenAdvisories
Medium · 5.4 Scanner template CVE-2021-37704 EUVD-2021-1686GHSA-cvh5-p6r6-g2qc

Exposed phpinfo() in PhpFastCache

Published Aug 12, 2021 · Updated Aug 4, 2024 · Assigned by GitHub_M

Vendor: PHPSocialNetwork Product: phpfastcache Package: phpfastcache/phpfastcache Ecosystem: Packagist

Description

PhpFastCache is a high-performance backend cache system (packagist package phpfastcache/phpfastcache). In versions before 6.1.5, 7.1.2, and 8.0.7 the `phpinfo()` can be exposed if the `/vendor` is not protected from public access. This is a rare situation today since the vendor directory is often located outside the web directory or protected via server rule (.htaccess, etc). Only the v6, v7 and v8 will be patched respectively in 8.0.7, 7.1.2, 6.1.5. Older versions such as v5, v4 are not longer supported and will **NOT** be patched. As a workaround, protect the `/vendor` directory from public access.

Affected products

VendorProductAffectedFixed
PHPSocialNetwork phpfastcache < 6.1.5, >= 7.0.0, < 7.1.2, >= 8.0.0, < 8.0.7 —

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist phpfastcache/phpfastcache < 6.1.5 6.1.5 GHSA-cvh5-p6r6-g2qc
Packagist phpfastcache/phpfastcache >= 7.0.0, < 7.1.2 7.1.2 GHSA-cvh5-p6r6-g2qc
Packagist phpfastcache/phpfastcache >= 8.0.0, < 8.0.7 8.0.7 GHSA-cvh5-p6r6-g2qc

References