CVE-2021-37704
Exposed phpinfo() leadked via documentation files
Impact
### Impact The `phpinfo()` can be exposed if the `/vendor` is not protected from public access. This is a rare situation today since the vendor directory is often located outside the web directory or protected via server rule (.htaccess, etc). ### Patches Only the v6, v7 and v8 will be patched respectively in 8.0.7, 7.1.2, 6.1.5. Older versions such as v5, v4 are not longer supported and will **NOT** be patched. ### Workarounds Protect the `/vendor` directory from public access. ### References The first issue revealing this vulnerability is located here: https://github.com/flextype/flextype/issues/567 V6 fix: https://github.com/PHPSocialNetwork/phpfastcache/pull/815 V7 fix: https://github.com/PHPSocialNetwork/phpfastcache/pull/814 V8 fix: https://github.com/PHPSocialNetwork/phpfastcache/pull/813 ### For more information If you have any questions or comments about this advisory: * Open an issue in [our issue tracker](https://github.com/PHPSocialNetwork/phpfastcache/issues) * Email us at [security@geolim4.com](mailto:security@geolim4.com)
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | phpfastcache/phpfastcache | < 6.1.5 | 6.1.5 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Phpfastcache | Phpfastcache | before 6.1.5 from 7.0.0 before 7.1.2 from 8.0.0 before 8.0.7 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/PHPSocialNetwork/phpfastcache/blob/master/CHANGELOG.md#807
- https://github.com/PHPSocialNetwork/phpfastcache/commit/41a77d0d8f126dbd6fbedcd9e6a82e86cdaafa51
- https://github.com/PHPSocialNetwork/phpfastcache/pull/813
- https://github.com/PHPSocialNetwork/phpfastcache/pull/814
- https://github.com/PHPSocialNetwork/phpfastcache/pull/815
- https://github.com/PHPSocialNetwork/phpfastcache/security/advisories/GHSA-cvh5-p6r6-g2qc
- https://github.com/flextype/flextype/issues/567
- https://packagist.org/packages/phpfastcache/phpfastcache
- https://github.com/advisories/GHSA-cvh5-p6r6-g2qc
- https://nvd.nist.gov/vuln/detail/CVE-2021-37704