Threats tagged 'bit-php-2024-5585'

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
High	–	EPSS 28%	CVE-2024-5585Php · Command injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix) HighEPSS 28%2024-06-12GCVE DatabaseCVE-2024-5585 CVE-2024-5585 is a command injection vulnerability in PHP affecting versions before 8.1.29, 8.2.20, and 8.3.8. It bypasses the fix for CVE-2024-1874 when the command name includes trailing spaces. The vulnerability arises from insufficient escaping in proc_open() when used with array syntax, allowing an attacker controlling command arguments to execute arbitrary commands on Windows shells. EPSS 28%Vulnerability #bit-php-2024-5585 #bitnami	GCVE Database	2024-06-12

Page 1 of 1