GHSA-3fgr-xjr6-xqm8

Suggest an improvement
Source
https://github.com/advisories/GHSA-3fgr-xjr6-xqm8
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/11/GHSA-3fgr-xjr6-xqm8/GHSA-3fgr-xjr6-xqm8.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-3fgr-xjr6-xqm8
Published
2022-11-28T22:07:33Z
Modified
2024-12-07T05:40:22.116741Z
Summary
code injection in phpxmlrpc/phpxmlrpc
Details

code injection in Wrapper::buildClientWrapperCode via manipulation of the $client argument. It was possible to force the client to access local files or connect to undesired urls instead of the intended target server's url.

Database specific
{
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-95"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2022-11-28T22:07:33Z"
}
References

Affected packages

Packagist / phpxmlrpc/phpxmlrpc

Package

Name
phpxmlrpc/phpxmlrpc
Purl
pkg:composer/phpxmlrpc/phpxmlrpc

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.9.0

Affected versions

3.*

3.0.0
3.0.1
3.1.0
3.1.1
3.1.2

4.*

4.0.0-alpha
4.0.0
4.0.1
4.1.0
4.1.1
4.2.0
4.2.1
4.2.2
4.3.0
4.3.1
4.3.2
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.6.0
4.6.1
4.7.0
4.7.1
4.7.2
4.8.0
4.8.1