CVE-2021-32708

🗓️ 24 Jun 2021 16:30:12Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 133 Views🌐 WEB

Flysystem PHP file storage library vulnerability allows remote code executio

Reporter	Title	Published	Views	Family All 23
GithubExploit	Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Thephpleague Flysystem	19 Oct 202412:49	–	githubexploit
Circl	CVE-2021-32708	24 Jun 202120:18	–	circl
CNNVD	thephpleague flysystem 代码注入漏洞	24 Jun 202100:00	–	cnnvd
Cvelist	CVE-2021-32708 Time-of-check Time-of-use (TOCTOU) Race Condition in league/flysystem	24 Jun 202116:30	–	cvelist
Debian CVE	CVE-2021-32708	24 Jun 202116:30	–	debiancve
EUVD	EUVD-2021-1300	7 Oct 202500:30	–	euvd
Fedora	[SECURITY] Fedora 33 Update: php-league-flysystem-1.1.4-1.fc33	4 Jul 202101:09	–	fedora
Fedora	[SECURITY] Fedora 34 Update: php-league-flysystem-1.1.4-1.fc34	4 Jul 202101:08	–	fedora
Friends Of PHP	TOCTOU Race Condition enabling remote code execution	23 Jun 202123:56	–	friendsofphp
Github Security Blog	Time-of-check Time-of-use (TOCTOU) Race Condition in league/flysystem	29 Jun 202103:13	–	github

NVD

Vulners

Node

thephpleague flysystemRange1.0.0–1.1.4

thephpleague flysystemRange2.0.0–2.1.1

Node

fedoraproject fedoraMatch33

fedoraproject fedoraMatch34

[
  {
    "product": "flysystem",
    "vendor": "thephpleague",
    "versions": [
      {
        "status": "affected",
        "version": "< 1.1.4"
      },
      {
        "status": "affected",
        "version": ">= 2.0.0, < 2.1.1"
      }
    ]
  }
]

Source	Link
github	www.github.com/thephpleague/flysystem/commit/f3ad69181b8afed2c9edf7be5a2918144ff4ea32
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NWPTENBYKI2IG47GI4DHAACLNRLTWUR5/
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNZSWK4GOMJOOHKLZEOE5AQSLC4DNCRZ/
github	www.github.com/thephpleague/flysystem/commit/a3c694de9f7e844b76f9d1b61296ebf6e8d89d74
packagist	www.packagist.org/packages/league/flysystem
github	www.github.com/thephpleague/flysystem/security/advisories/GHSA-9f46-5r25-5wfm

Parameter	Position	Path	Description	CWE
filename	path	output/si.php	Unicode whitespace normalization bug can be bypassed via crafted filename to upload/execute arbitrary PHP code on server	CWE-367

21 Nov 2024 06:07Current

8.3High risk

Vulners AI Score8.3

CVSS 3.18.1 - 9.8

CVSS 29.3

EPSS0.07327

CWE-367