CVE-2024-1874

Advisory lineage Upstream: 0 Downstream: 2
Modified
Published: 29 Apr 2024, 03:57
Last modified:04 Nov 2025, 18:22

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.4 CRITICAL
v3.1 (cve.org)
EPSS Score
68.57% CRITICAL
69% probability +11.02%
KEV
Not listed
Ransomware
No reports
Public exploits
2 found
Dark Web
Not detected

Timeline

29 Apr 2024, 03:57
Published
Vulnerability first disclosed
04 Nov 2025, 18:22
Last Modified
Vulnerability information updated

Description

In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.

CVSS Metrics

  • v3.1•CRITICAL•Score: 9.4CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

EPSS Trends

Current EPSS score: 68.57%• Percentile: 99%

Techniques & Countermeasures

  • CWE-116•Improper Encoding or Escaping of Output

    The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Affected Systems

  • fedoraproject•fedora

    39 | 40

  • Unknown•PHP

    ≥ 8.1.*, < 8.1.28 | ≥ 8.2.*, < 8.2.18 | ≥ 8.3.*, < 8.3.5

  • Unknown•PHP

    ≥ 8.1.0, < 8.1.28 | ≥ 8.2.0, < 8.2.18 | ≥ 8.3.0, < 8.3.5

References (10)