CVE-2024-1874

2024-04-2904:15:07

Alpine Linux Development Team

security.alpinelinux.org

180

php

proc_open

command execution

vulnerability

windows

8.4 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

8.6%

JSON

In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.

OSVersionArchitecturePackageVersionFilename
Alpineedge-communitynoarchphp82< 8.2.18-r0UNKNOWN
Alpineedge-communitynoarchphp83< 8.3.5-r0UNKNOWN
Alpine3.19-communitynoarchphp81< 8.1.28-r0UNKNOWN
Alpine3.19-communitynoarchphp82< 8.2.18-r0UNKNOWN
Alpine3.19-communitynoarchphp83< 8.3.6-r0UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Alpine	edge-community	noarch	php82	< 8.2.18-r0	UNKNOWN
Alpine	edge-community	noarch	php83	< 8.3.5-r0	UNKNOWN
Alpine	3.19-community	noarch	php81	< 8.1.28-r0	UNKNOWN
Alpine	3.19-community	noarch	php82	< 8.2.18-r0	UNKNOWN
Alpine	3.19-community	noarch	php83	< 8.3.6-r0	UNKNOWN