logo

Database

Remote command execution In craftcms/cms

Description

Craft CMS has potential RCE when PHP register_argc_argv config setting is enabled

Impact

You are affected if your php.ini configuration has register_argc_argv enabled.

Patches

Update to 3.9.14, 4.13.2, or 5.5.2.

Workarounds

If you can't upgrade yet, and register_argc_argv is enabled, you can disable it to mitigate the issue.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2024-561452. NVD-2024-561453. OSV-2024-561454. GHSA-2p6p-9rc9-62j95. GCVE-2024-56145

References

1. https://github.com/craftcms/cms/security/advisories/GHSA-2p6p-9rc9-62j92. https://github.com/craftcms/cms/commit/82e893fb794d30563da296bca31379c0df0079b33. https://github.com/Chocapikk/CVE-2024-561454. https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-561455. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-56145.yaml6. https://github.com/Sachinart/CVE-2024-56145-craftcms-rce7. https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/craftcms_ftp_template.rb

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.