CVE-2024-50340
Improper Input Validation (CWE-20)
Summary
When the register_argc_argv php directive is set to on, and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by the kernel when handling the request.
Impact
This vulnerability allows attackers to manipulate the environment or debug mode of the kernel during request handling. This could potentially lead to unauthorized access, information disclosure, or execution of unintended operations on the affected system. The ability to change these settings could give attackers significant control over the application's behavior, potentially compromising its security and integrity.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
A patch is available. According to the vulnerability data, patch details were added on 2024-11-06, and the vulnerability is marked as patched.
Mitigation
1. Update to the latest patched version of the affected software as soon as possible. 2. If immediate patching is not possible, consider disabling the register_argc_argv php directive by setting it to 'off' if it's not critical for your application's functionality. 3. Implement strong input validation and sanitization for all user-supplied data, especially in URL query strings. 4. Monitor and log any unusual activities or requests that might attempt to exploit this vulnerability. 5. Apply the principle of least privilege to limit the potential impact if the vulnerability is exploited.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Timeline
Feedly found the first article mentioning CVE-2024-50340. See article
Feedly estimated the CVSS score as HIGH
CVE-2024-50340 is a medium-risk vulnerability with four associated vulnerabilities, for which a patch is available. There is no information provided regarding its exploitation in the wild, proof-of-concept exploits, or any downstream impacts on third-party vendors or technology. Vulnerability analysts should prioritize applying the available patch to mitigate potential risks. See article
NVD published the first details for CVE-2024-50340
A CVSS base score of 7.3 has been assigned.
EPSS Score was set to: 0.04% (Percentile: 10%)
Detection for the vulnerability has been added to Nessus (210744)
Attacks in the wild have been reported by Talkback Tech. See article