CVE-2023-49283 (GCVE-0-2023-49283)
Vulnerability from cvelistv5
Published
2023-12-05 22:44
Modified
2024-10-10 19:07
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Summary
microsoft-graph-core the Microsoft Graph Library for PHP. The Microsoft Graph Beta PHP SDK published packages which contained test code that enabled the use of the phpInfo() function from any application that could access and execute the file at `vendor/microsoft/microsoft-graph-core/tests/GetPhpInfo.php`. The phpInfo function exposes system information. The vulnerability affects the GetPhpInfo.php script of the PHP SDK which contains a call to the phpinfo() function. This vulnerability requires a misconfiguration of the server to be present so it can be exploited. For example, making the PHP application’s /vendor directory web accessible. The combination of the vulnerability and the server misconfiguration would allow an attacker to craft an HTTP request that executes the phpinfo() method. The attacker would then be able to get access to system information like configuration, modules, and environment variables and later on use the compromised secrets to access additional data. This problem has been patched in version 2.0.2. If an immediate deployment with the updated vendor package is not available, you can perform the following temporary workarounds: delete the `vendor/microsoft/microsoft-graph-core/tests/GetPhpInfo.php` file, remove access to the /vendor directory, or disable the phpinfo function
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| microsoftgraph | msgraph-sdk-php-core |
Version: < 2.0.2 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T21:53:44.992Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/microsoftgraph/msgraph-sdk-php-core/security/advisories/GHSA-mhhp-c3cm-2r86",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/microsoftgraph/msgraph-sdk-php-core/security/advisories/GHSA-mhhp-c3cm-2r86"
},
{
"name": "https://github.com/microsoftgraph/msgraph-beta-sdk-php/compare/2.0.0...2.0.1",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/microsoftgraph/msgraph-beta-sdk-php/compare/2.0.0...2.0.1"
},
{
"name": "https://github.com/microsoftgraph/msgraph-sdk-php-core/compare/2.0.1...2.0.2",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/microsoftgraph/msgraph-sdk-php-core/compare/2.0.1...2.0.2"
},
{
"name": "https://github.com/microsoftgraph/msgraph-sdk-php/compare/1.109.0...1.109.1",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/microsoftgraph/msgraph-sdk-php/compare/1.109.0...1.109.1"
},
{
"name": "https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-49283",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-10T19:06:47.520044Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-10T19:07:45.469Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "msgraph-sdk-php-core",
"vendor": "microsoftgraph",
"versions": [
{
"status": "affected",
"version": "\u003c 2.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "microsoft-graph-core the Microsoft Graph Library for PHP. The Microsoft Graph Beta PHP SDK published packages which contained test code that enabled the use of the phpInfo() function from any application that could access and execute the file at `vendor/microsoft/microsoft-graph-core/tests/GetPhpInfo.php`. The phpInfo function exposes system information. The vulnerability affects the GetPhpInfo.php script of the PHP SDK which contains a call to the phpinfo() function. This vulnerability requires a misconfiguration of the server to be present so it can be exploited. For example, making the PHP application\u2019s /vendor directory web accessible. The combination of the vulnerability and the server misconfiguration would allow an attacker to craft an HTTP request that executes the phpinfo() method. The attacker would then be able to get access to system information like configuration, modules, and environment variables and later on use the compromised secrets to access additional data. This problem has been patched in version 2.0.2. If an immediate deployment with the updated vendor package is not available, you can perform the following temporary workarounds: delete the `vendor/microsoft/microsoft-graph-core/tests/GetPhpInfo.php` file, remove access to the /vendor directory, or disable the phpinfo function\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-12-05T22:44:40.433Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/microsoftgraph/msgraph-sdk-php-core/security/advisories/GHSA-mhhp-c3cm-2r86",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/microsoftgraph/msgraph-sdk-php-core/security/advisories/GHSA-mhhp-c3cm-2r86"
},
{
"name": "https://github.com/microsoftgraph/msgraph-beta-sdk-php/compare/2.0.0...2.0.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoftgraph/msgraph-beta-sdk-php/compare/2.0.0...2.0.1"
},
{
"name": "https://github.com/microsoftgraph/msgraph-sdk-php-core/compare/2.0.1...2.0.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoftgraph/msgraph-sdk-php-core/compare/2.0.1...2.0.2"
},
{
"name": "https://github.com/microsoftgraph/msgraph-sdk-php/compare/1.109.0...1.109.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/microsoftgraph/msgraph-sdk-php/compare/1.109.0...1.109.1"
},
{
"name": "https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/",
"tags": [
"x_refsource_MISC"
],
"url": "https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/"
}
],
"source": {
"advisory": "GHSA-mhhp-c3cm-2r86",
"discovery": "UNKNOWN"
},
"title": "Test code in published microsoft-graph-core package exposes phpinfo()"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-49283",
"datePublished": "2023-12-05T22:44:40.433Z",
"dateReserved": "2023-11-24T16:45:24.312Z",
"dateUpdated": "2024-10-10T19:07:45.469Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"cna\": {\"title\": \"Test code in published microsoft-graph-core package exposes phpinfo()\", \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-200\", \"lang\": \"en\", \"description\": \"CWE-200: Exposure of Sensitive Information to an Unauthorized Actor\", \"type\": \"CWE\"}]}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"LOW\", \"baseScore\": 5.4, \"baseSeverity\": \"MEDIUM\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L\", \"version\": \"3.1\"}}], \"references\": [{\"name\": \"https://github.com/microsoftgraph/msgraph-sdk-php-core/security/advisories/GHSA-mhhp-c3cm-2r86\", \"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://github.com/microsoftgraph/msgraph-sdk-php-core/security/advisories/GHSA-mhhp-c3cm-2r86\"}, {\"name\": \"https://github.com/microsoftgraph/msgraph-beta-sdk-php/compare/2.0.0...2.0.1\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/microsoftgraph/msgraph-beta-sdk-php/compare/2.0.0...2.0.1\"}, {\"name\": \"https://github.com/microsoftgraph/msgraph-sdk-php-core/compare/2.0.1...2.0.2\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/microsoftgraph/msgraph-sdk-php-core/compare/2.0.1...2.0.2\"}, {\"name\": \"https://github.com/microsoftgraph/msgraph-sdk-php/compare/1.109.0...1.109.1\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/microsoftgraph/msgraph-sdk-php/compare/1.109.0...1.109.1\"}, {\"name\": \"https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/\"}], \"affected\": [{\"vendor\": \"microsoftgraph\", \"product\": \"msgraph-sdk-php-core\", \"versions\": [{\"version\": \"\u003c 2.0.2\", \"status\": \"affected\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2023-12-05T22:44:40.433Z\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"microsoft-graph-core the Microsoft Graph Library for PHP. The Microsoft Graph Beta PHP SDK published packages which contained test code that enabled the use of the phpInfo() function from any application that could access and execute the file at `vendor/microsoft/microsoft-graph-core/tests/GetPhpInfo.php`. The phpInfo function exposes system information. The vulnerability affects the GetPhpInfo.php script of the PHP SDK which contains a call to the phpinfo() function. This vulnerability requires a misconfiguration of the server to be present so it can be exploited. For example, making the PHP application\\u2019s /vendor directory web accessible. The combination of the vulnerability and the server misconfiguration would allow an attacker to craft an HTTP request that executes the phpinfo() method. The attacker would then be able to get access to system information like configuration, modules, and environment variables and later on use the compromised secrets to access additional data. This problem has been patched in version 2.0.2. If an immediate deployment with the updated vendor package is not available, you can perform the following temporary workarounds: delete the `vendor/microsoft/microsoft-graph-core/tests/GetPhpInfo.php` file, remove access to the /vendor directory, or disable the phpinfo function\\n\"}], \"source\": {\"advisory\": \"GHSA-mhhp-c3cm-2r86\", \"discovery\": \"UNKNOWN\"}}, \"adp\": [{\"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T21:53:44.992Z\"}, \"title\": \"CVE Program Container\", \"references\": [{\"name\": \"https://github.com/microsoftgraph/msgraph-sdk-php-core/security/advisories/GHSA-mhhp-c3cm-2r86\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"], \"url\": \"https://github.com/microsoftgraph/msgraph-sdk-php-core/security/advisories/GHSA-mhhp-c3cm-2r86\"}, {\"name\": \"https://github.com/microsoftgraph/msgraph-beta-sdk-php/compare/2.0.0...2.0.1\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"], \"url\": \"https://github.com/microsoftgraph/msgraph-beta-sdk-php/compare/2.0.0...2.0.1\"}, {\"name\": \"https://github.com/microsoftgraph/msgraph-sdk-php-core/compare/2.0.1...2.0.2\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"], \"url\": \"https://github.com/microsoftgraph/msgraph-sdk-php-core/compare/2.0.1...2.0.2\"}, {\"name\": \"https://github.com/microsoftgraph/msgraph-sdk-php/compare/1.109.0...1.109.1\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"], \"url\": \"https://github.com/microsoftgraph/msgraph-sdk-php/compare/1.109.0...1.109.1\"}, {\"name\": \"https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"], \"url\": \"https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/\"}]}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-49283\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-10T19:06:47.520044Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-10T19:07:40.762Z\"}}]}",
"cveMetadata": "{\"cveId\": \"CVE-2023-49283\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"GitHub_M\", \"dateReserved\": \"2023-11-24T16:45:24.312Z\", \"datePublished\": \"2023-12-05T22:44:40.433Z\", \"dateUpdated\": \"2024-10-10T19:07:45.469Z\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…