Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

microsoft/microsoft-graph-core

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.4PackagistPublished

    Test code in published microsoft-graph-core package exposes phpinfo()

    CVE-2023-49283 · GHSA-mhhp-c3cm-2r86

    Affected
    • Packagist microsoft/microsoft-graph-core < 2.0.2
    Fixed in
    2.0.2· Vendor fix available
    Issue
    Impact The Microsoft Graph Core PHP SDK published packages which contained test code that enabled the use of the phpInfo() function from any application that could access and execute the file at vendor/microsoft/microsoft-graph-core/tests/GetPhpInfo.php. The phpInfo function exposes system information. The vulnerability affects the GetPhpInfo.php script of the PHP SDK which contains a call to the phpinfo() function. This vulnerability requires a misconfiguration of the server to be present so it can be exploited. For example, making the PHP application’s /vendor directory web accessible. The combination of the vulnerability and the server misconfiguration would allow an attacker to craft an HTTP request that executes the phpinfo() method. The attacker would then be able to get access to system information like configuration, modules, and environment variables and later on use the compromised secrets to access additional data. Patches This problem has been patched in version 2.0.2.…

    Recommended action: Upgrade to 2.0.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →