GitHub Advisoryadvisory · Packagist

GHSA-hpj2-4hfj-g233 Fat-Free Framework arbitrary code execution

CRITICAL Published 2022-05-24 Modified 2024-04-25 Official page ↗
Aliases
CVE-2020-5203
Ecosystem
Packagist
Packages
bcosca/fatfree
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-74
Reviewed
2024-04-25

Affected packages

• Packagist bcosca/fatfree: < 3.7.2 → fixed in 3.7.2

Description

In Fat-Free Framework 3.7.1, attackers can achieve arbitrary code execution if developers choose to pass user controlled input (e.g., `$_REQUEST`, `$_GET`, or `$_POST`) to the framework's Clear method.

Related

Alias · CVE (1)

  • CVE-2020-5203 In Fat-Free Framework 3.7.1, attackers can achieve arbitrary code execution if developers choose to pass user controlled input (e.g.,… vulnerability

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References