Vulnerability-Lookup

CVE-2023-49283 (GCVE-0-2023-49283)

Vulnerability from cvelistv5 – Published: 2023-12-05 22:44 – Updated: 2024-10-10 19:07

Title

Test code in published microsoft-graph-core package exposes phpinfo()

Summary

microsoft-graph-core the Microsoft Graph Library for PHP. The Microsoft Graph Beta PHP SDK published packages which contained test code that enabled the use of the phpInfo() function from any application that could access and execute the file at `vendor/microsoft/microsoft-graph-core/tests/GetPhpInfo.php`. The phpInfo function exposes system information. The vulnerability affects the GetPhpInfo.php script of the PHP SDK which contains a call to the phpinfo() function. This vulnerability requires a misconfiguration of the server to be present so it can be exploited. For example, making the PHP application’s /vendor directory web accessible. The combination of the vulnerability and the server misconfiguration would allow an attacker to craft an HTTP request that executes the phpinfo() method. The attacker would then be able to get access to system information like configuration, modules, and environment variables and later on use the compromised secrets to access additional data. This problem has been patched in version 2.0.2. If an immediate deployment with the updated vendor package is not available, you can perform the following temporary workarounds: delete the `vendor/microsoft/microsoft-graph-core/tests/GetPhpInfo.php` file, remove access to the /vendor directory, or disable the phpinfo function

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-10 19:06 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7789 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/microsoftgraph/msgraph-sdk-php…	x_refsource_CONFIRM
https://github.com/microsoftgraph/msgraph-beta-sd…	x_refsource_MISC
https://github.com/microsoftgraph/msgraph-sdk-php…	x_refsource_MISC
https://github.com/microsoftgraph/msgraph-sdk-php…	x_refsource_MISC
https://owncloud.com/security-advisories/disclosu…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
microsoftgraph	msgraph-sdk-php-core	Affected: < 2.0.2	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T21:53:44.992Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/microsoftgraph/msgraph-sdk-php-core/security/advisories/GHSA-mhhp-c3cm-2r86",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/microsoftgraph/msgraph-sdk-php-core/security/advisories/GHSA-mhhp-c3cm-2r86"
          },
          {
            "name": "https://github.com/microsoftgraph/msgraph-beta-sdk-php/compare/2.0.0...2.0.1",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/microsoftgraph/msgraph-beta-sdk-php/compare/2.0.0...2.0.1"
          },
          {
            "name": "https://github.com/microsoftgraph/msgraph-sdk-php-core/compare/2.0.1...2.0.2",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/microsoftgraph/msgraph-sdk-php-core/compare/2.0.1...2.0.2"
          },
          {
            "name": "https://github.com/microsoftgraph/msgraph-sdk-php/compare/1.109.0...1.109.1",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/microsoftgraph/msgraph-sdk-php/compare/1.109.0...1.109.1"
          },
          {
            "name": "https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-49283",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-10T19:06:47.520044Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-10T19:07:45.469Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "msgraph-sdk-php-core",
          "vendor": "microsoftgraph",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.0.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "microsoft-graph-core the Microsoft Graph Library for PHP. The Microsoft Graph Beta PHP SDK published packages which contained test code that enabled the use of the phpInfo() function from any application that could access and execute the file at `vendor/microsoft/microsoft-graph-core/tests/GetPhpInfo.php`. The phpInfo function exposes system information. The vulnerability affects the GetPhpInfo.php script of the PHP SDK which contains a call to the phpinfo() function. This vulnerability requires a misconfiguration of the server to be present so it can be exploited. For example, making the PHP application\u2019s /vendor directory web accessible. The combination of the vulnerability and the server misconfiguration would allow an attacker to craft an HTTP request that executes the phpinfo() method. The attacker would then be able to get access to system information like configuration, modules, and environment variables and later on use the compromised secrets to access additional data. This problem has been patched in version 2.0.2. If an immediate deployment with the updated vendor package is not available, you can perform the following temporary workarounds: delete the `vendor/microsoft/microsoft-graph-core/tests/GetPhpInfo.php` file, remove access to the /vendor directory, or disable the phpinfo function\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-05T22:44:40.433Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/microsoftgraph/msgraph-sdk-php-core/security/advisories/GHSA-mhhp-c3cm-2r86",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/microsoftgraph/msgraph-sdk-php-core/security/advisories/GHSA-mhhp-c3cm-2r86"
        },
        {
          "name": "https://github.com/microsoftgraph/msgraph-beta-sdk-php/compare/2.0.0...2.0.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/microsoftgraph/msgraph-beta-sdk-php/compare/2.0.0...2.0.1"
        },
        {
          "name": "https://github.com/microsoftgraph/msgraph-sdk-php-core/compare/2.0.1...2.0.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/microsoftgraph/msgraph-sdk-php-core/compare/2.0.1...2.0.2"
        },
        {
          "name": "https://github.com/microsoftgraph/msgraph-sdk-php/compare/1.109.0...1.109.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/microsoftgraph/msgraph-sdk-php/compare/1.109.0...1.109.1"
        },
        {
          "name": "https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/"
        }
      ],
      "source": {
        "advisory": "GHSA-mhhp-c3cm-2r86",
        "discovery": "UNKNOWN"
      },
      "title": "Test code in published microsoft-graph-core package exposes phpinfo()"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-49283",
    "datePublished": "2023-12-05T22:44:40.433Z",
    "dateReserved": "2023-11-24T16:45:24.312Z",
    "dateUpdated": "2024-10-10T19:07:45.469Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-49283",
      "date": "2026-11-10",
      "epss": "0.02203",
      "percentile": "0.8269"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "msgraph-sdk-php-core",
                "vendor": "microsoftgraph",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 2.0.2"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:microsoft:graph:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6FCA6E9B-A894-41C6-81D6-036C43487BBD",
                    "versionEndExcluding": "2.0.2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "microsoft-graph-core the Microsoft Graph Library for PHP. The Microsoft Graph Beta PHP SDK published packages which contained test code that enabled the use of the phpInfo() function from any application that could access and execute the file at `vendor/microsoft/microsoft-graph-core/tests/GetPhpInfo.php`. The phpInfo function exposes system information. The vulnerability affects the GetPhpInfo.php script of the PHP SDK which contains a call to the phpinfo() function. This vulnerability requires a misconfiguration of the server to be present so it can be exploited. For example, making the PHP application\u2019s /vendor directory web accessible. The combination of the vulnerability and the server misconfiguration would allow an attacker to craft an HTTP request that executes the phpinfo() method. The attacker would then be able to get access to system information like configuration, modules, and environment variables and later on use the compromised secrets to access additional data. This problem has been patched in version 2.0.2. If an immediate deployment with the updated vendor package is not available, you can perform the following temporary workarounds: delete the `vendor/microsoft/microsoft-graph-core/tests/GetPhpInfo.php` file, remove access to the /vendor directory, or disable the phpinfo function\n"
          },
          {
            "lang": "es",
            "value": "microsoft-graph-core la librer\u00eda Microsoft Graph para PHP. El SDK PHP Beta de Microsoft Graph public\u00f3 paquetes que conten\u00edan c\u00f3digo de prueba que permit\u00eda el uso de la funci\u00f3n phpInfo() desde cualquier aplicaci\u00f3n que pudiera acceder y ejecutar el archivo en `vendor/microsoft/microsoft-graph-core/tests/GetPhpInfo.php`. La funci\u00f3n phpInfo expone informaci\u00f3n del sistema. La vulnerabilidad afecta al script GetPhpInfo.php del SDK de PHP que contiene una llamada a la funci\u00f3n phpinfo(). Esta vulnerabilidad requiere que est\u00e9 presente una mala configuraci\u00f3n del servidor para poder explotarla. Por ejemplo, hacer que el directorio web/proveedor de la aplicaci\u00f3n PHP sea accesible. La combinaci\u00f3n de la vulnerabilidad y la mala configuraci\u00f3n del servidor permitir\u00eda a un atacante crear una solicitud HTTP que ejecute el m\u00e9todo phpinfo(). Luego, el atacante podr\u00eda obtener acceso a informaci\u00f3n del sistema, como configuraci\u00f3n, m\u00f3dulos y variables de entorno, y luego utilizar los secretos comprometidos para acceder a datos adicionales. Este problema se ha solucionado en la versi\u00f3n 2.0.2. Si no est\u00e1 disponible una implementaci\u00f3n inmediata con el paquete de proveedor actualizado, puede realizar las siguientes soluciones temporales: eliminar el archivo `vendor/microsoft/microsoft-graph-core/tests/GetPhpInfo.php`, eliminar el acceso al directorio /vendor, o desactivar la funci\u00f3n phpinfo"
          }
        ],
        "id": "CVE-2023-49283",
        "lastModified": "2026-06-17T06:35:45.780",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 5.4,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 2.5,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 1.4,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2023-49283",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-10T19:06:47.520044Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2023-12-05T23:15:07.323",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/microsoftgraph/msgraph-beta-sdk-php/compare/2.0.0...2.0.1"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/microsoftgraph/msgraph-sdk-php-core/compare/2.0.1...2.0.2"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://github.com/microsoftgraph/msgraph-sdk-php-core/security/advisories/GHSA-mhhp-c3cm-2r86"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/microsoftgraph/msgraph-sdk-php/compare/1.109.0...1.109.1"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/microsoftgraph/msgraph-beta-sdk-php/compare/2.0.0...2.0.1"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/microsoftgraph/msgraph-sdk-php-core/compare/2.0.1...2.0.2"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://github.com/microsoftgraph/msgraph-sdk-php-core/security/advisories/GHSA-mhhp-c3cm-2r86"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/microsoftgraph/msgraph-sdk-php/compare/1.109.0...1.109.1"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-200"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T21:53:44.992Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "name": "https://github.com/microsoftgraph/msgraph-sdk-php-core/security/advisories/GHSA-mhhp-c3cm-2r86",
                "tags": [
                  "x_refsource_CONFIRM",
                  "x_transferred"
                ],
                "url": "https://github.com/microsoftgraph/msgraph-sdk-php-core/security/advisories/GHSA-mhhp-c3cm-2r86"
              },
              {
                "name": "https://github.com/microsoftgraph/msgraph-beta-sdk-php/compare/2.0.0...2.0.1",
                "tags": [
                  "x_refsource_MISC",
                  "x_transferred"
                ],
                "url": "https://github.com/microsoftgraph/msgraph-beta-sdk-php/compare/2.0.0...2.0.1"
              },
              {
                "name": "https://github.com/microsoftgraph/msgraph-sdk-php-core/compare/2.0.1...2.0.2",
                "tags": [
                  "x_refsource_MISC",
                  "x_transferred"
                ],
                "url": "https://github.com/microsoftgraph/msgraph-sdk-php-core/compare/2.0.1...2.0.2"
              },
              {
                "name": "https://github.com/microsoftgraph/msgraph-sdk-php/compare/1.109.0...1.109.1",
                "tags": [
                  "x_refsource_MISC",
                  "x_transferred"
                ],
                "url": "https://github.com/microsoftgraph/msgraph-sdk-php/compare/1.109.0...1.109.1"
              },
              {
                "name": "https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/",
                "tags": [
                  "x_refsource_MISC",
                  "x_transferred"
                ],
                "url": "https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2023-49283",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-10-10T19:06:47.520044Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-10-10T19:07:40.762Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "msgraph-sdk-php-core",
              "vendor": "microsoftgraph",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 2.0.2"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "microsoft-graph-core the Microsoft Graph Library for PHP. The Microsoft Graph Beta PHP SDK published packages which contained test code that enabled the use of the phpInfo() function from any application that could access and execute the file at `vendor/microsoft/microsoft-graph-core/tests/GetPhpInfo.php`. The phpInfo function exposes system information. The vulnerability affects the GetPhpInfo.php script of the PHP SDK which contains a call to the phpinfo() function. This vulnerability requires a misconfiguration of the server to be present so it can be exploited. For example, making the PHP application\u2019s /vendor directory web accessible. The combination of the vulnerability and the server misconfiguration would allow an attacker to craft an HTTP request that executes the phpinfo() method. The attacker would then be able to get access to system information like configuration, modules, and environment variables and later on use the compromised secrets to access additional data. This problem has been patched in version 2.0.2. If an immediate deployment with the updated vendor package is not available, you can perform the following temporary workarounds: delete the `vendor/microsoft/microsoft-graph-core/tests/GetPhpInfo.php` file, remove access to the /vendor directory, or disable the phpinfo function\n"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 5.4,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-200",
                  "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2023-12-05T22:44:40.433Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/microsoftgraph/msgraph-sdk-php-core/security/advisories/GHSA-mhhp-c3cm-2r86",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/microsoftgraph/msgraph-sdk-php-core/security/advisories/GHSA-mhhp-c3cm-2r86"
            },
            {
              "name": "https://github.com/microsoftgraph/msgraph-beta-sdk-php/compare/2.0.0...2.0.1",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/microsoftgraph/msgraph-beta-sdk-php/compare/2.0.0...2.0.1"
            },
            {
              "name": "https://github.com/microsoftgraph/msgraph-sdk-php-core/compare/2.0.1...2.0.2",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/microsoftgraph/msgraph-sdk-php-core/compare/2.0.1...2.0.2"
            },
            {
              "name": "https://github.com/microsoftgraph/msgraph-sdk-php/compare/1.109.0...1.109.1",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/microsoftgraph/msgraph-sdk-php/compare/1.109.0...1.109.1"
            },
            {
              "name": "https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/"
            }
          ],
          "source": {
            "advisory": "GHSA-mhhp-c3cm-2r86",
            "discovery": "UNKNOWN"
          },
          "title": "Test code in published microsoft-graph-core package exposes phpinfo()"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2023-49283",
        "datePublished": "2023-12-05T22:44:40.433Z",
        "dateReserved": "2023-11-24T16:45:24.312Z",
        "dateUpdated": "2024-10-10T19:07:45.469Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2023-49283

Vulnerability from fkie_nvd - Published: 2023-12-05 23:15 - Updated: 2026-06-17 06:35

Severity

5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/microsoftgraph/msgraph-beta-sdk-php/compare/2.0.0...2.0.1	Patch
security-advisories@github.com	https://github.com/microsoftgraph/msgraph-sdk-php-core/compare/2.0.1...2.0.2	Patch
security-advisories@github.com	https://github.com/microsoftgraph/msgraph-sdk-php-core/security/advisories/GHSA-mhhp-c3cm-2r86	Patch, Vendor Advisory
security-advisories@github.com	https://github.com/microsoftgraph/msgraph-sdk-php/compare/1.109.0...1.109.1	Patch
security-advisories@github.com	https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/microsoftgraph/msgraph-beta-sdk-php/compare/2.0.0...2.0.1	Patch
af854a3a-2127-422b-91ae-364da2661108	https://github.com/microsoftgraph/msgraph-sdk-php-core/compare/2.0.1...2.0.2	Patch
af854a3a-2127-422b-91ae-364da2661108	https://github.com/microsoftgraph/msgraph-sdk-php-core/security/advisories/GHSA-mhhp-c3cm-2r86	Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/microsoftgraph/msgraph-sdk-php/compare/1.109.0...1.109.1	Patch
af854a3a-2127-422b-91ae-364da2661108	https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/	Third Party Advisory

Impacted products

	Vendor	Product	Version
	microsoft	graph	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "msgraph-sdk-php-core",
          "vendor": "microsoftgraph",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.0.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:graph:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6FCA6E9B-A894-41C6-81D6-036C43487BBD",
              "versionEndExcluding": "2.0.2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "microsoft-graph-core the Microsoft Graph Library for PHP. The Microsoft Graph Beta PHP SDK published packages which contained test code that enabled the use of the phpInfo() function from any application that could access and execute the file at `vendor/microsoft/microsoft-graph-core/tests/GetPhpInfo.php`. The phpInfo function exposes system information. The vulnerability affects the GetPhpInfo.php script of the PHP SDK which contains a call to the phpinfo() function. This vulnerability requires a misconfiguration of the server to be present so it can be exploited. For example, making the PHP application\u2019s /vendor directory web accessible. The combination of the vulnerability and the server misconfiguration would allow an attacker to craft an HTTP request that executes the phpinfo() method. The attacker would then be able to get access to system information like configuration, modules, and environment variables and later on use the compromised secrets to access additional data. This problem has been patched in version 2.0.2. If an immediate deployment with the updated vendor package is not available, you can perform the following temporary workarounds: delete the `vendor/microsoft/microsoft-graph-core/tests/GetPhpInfo.php` file, remove access to the /vendor directory, or disable the phpinfo function\n"
    },
    {
      "lang": "es",
      "value": "microsoft-graph-core la librer\u00eda Microsoft Graph para PHP. El SDK PHP Beta de Microsoft Graph public\u00f3 paquetes que conten\u00edan c\u00f3digo de prueba que permit\u00eda el uso de la funci\u00f3n phpInfo() desde cualquier aplicaci\u00f3n que pudiera acceder y ejecutar el archivo en `vendor/microsoft/microsoft-graph-core/tests/GetPhpInfo.php`. La funci\u00f3n phpInfo expone informaci\u00f3n del sistema. La vulnerabilidad afecta al script GetPhpInfo.php del SDK de PHP que contiene una llamada a la funci\u00f3n phpinfo(). Esta vulnerabilidad requiere que est\u00e9 presente una mala configuraci\u00f3n del servidor para poder explotarla. Por ejemplo, hacer que el directorio web/proveedor de la aplicaci\u00f3n PHP sea accesible. La combinaci\u00f3n de la vulnerabilidad y la mala configuraci\u00f3n del servidor permitir\u00eda a un atacante crear una solicitud HTTP que ejecute el m\u00e9todo phpinfo(). Luego, el atacante podr\u00eda obtener acceso a informaci\u00f3n del sistema, como configuraci\u00f3n, m\u00f3dulos y variables de entorno, y luego utilizar los secretos comprometidos para acceder a datos adicionales. Este problema se ha solucionado en la versi\u00f3n 2.0.2. Si no est\u00e1 disponible una implementaci\u00f3n inmediata con el paquete de proveedor actualizado, puede realizar las siguientes soluciones temporales: eliminar el archivo `vendor/microsoft/microsoft-graph-core/tests/GetPhpInfo.php`, eliminar el acceso al directorio /vendor, o desactivar la funci\u00f3n phpinfo"
    }
  ],
  "id": "CVE-2023-49283",
  "lastModified": "2026-06-17T06:35:45.780",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.5,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-49283",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-10-10T19:06:47.520044Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2023-12-05T23:15:07.323",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/microsoftgraph/msgraph-beta-sdk-php/compare/2.0.0...2.0.1"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/microsoftgraph/msgraph-sdk-php-core/compare/2.0.1...2.0.2"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/microsoftgraph/msgraph-sdk-php-core/security/advisories/GHSA-mhhp-c3cm-2r86"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/microsoftgraph/msgraph-sdk-php/compare/1.109.0...1.109.1"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/microsoftgraph/msgraph-beta-sdk-php/compare/2.0.0...2.0.1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/microsoftgraph/msgraph-sdk-php-core/compare/2.0.1...2.0.2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/microsoftgraph/msgraph-sdk-php-core/security/advisories/GHSA-mhhp-c3cm-2r86"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/microsoftgraph/msgraph-sdk-php/compare/1.109.0...1.109.1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-MHHP-C3CM-2R86

Vulnerability from github – Published: 2023-12-05 22:46 – Updated: 2024-02-07 16:17

Summary

Test code in published microsoft-graph-core package exposes phpinfo()

Details

Impact

The Microsoft Graph Core PHP SDK published packages which contained test code that enabled the use of the phpInfo() function from any application that could access and execute the file at vendor/microsoft/microsoft-graph-core/tests/GetPhpInfo.php. The phpInfo function exposes system information.

The vulnerability affects the GetPhpInfo.php script of the PHP SDK which contains a call to the phpinfo() function.

This vulnerability requires a misconfiguration of the server to be present so it can be exploited. For example, making the PHP application’s /vendor directory web accessible.

The combination of the vulnerability and the server misconfiguration would allow an attacker to craft an HTTP request that executes the phpinfo() method. The attacker would then be able to get access to system information like configuration, modules, and environment variables and later on use the compromised secrets to access additional data.

Patches

This problem has been patched in version 2.0.2.

Workarounds

If an immediate deployment with the updated vendor package is not available, you can perform the following temporary workarounds: - delete the vendor/microsoft/microsoft-graph-core/tests/GetPhpInfo.php file - remove access to the /vendor directory will remove this vulnerability - disable the phpinfo function

References

For more information about the vulnerability and the patch, users can refer to the following sources:

https://nvd.nist.gov/vuln/detail/CVE-2023-49103
https://github.com/microsoftgraph/msgraph-beta-sdk-php/compare/2.0.0...2.0.1
https://github.com/microsoftgraph/msgraph-sdk-php-core/compare/2.0.1...2.0.2
https://github.com/microsoftgraph/msgraph-sdk-php/compare/1.109.0...1.109.1
https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/

Severity

5.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "microsoft/microsoft-graph-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-49283"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-12-05T22:46:57Z",
    "nvd_published_at": "2023-12-05T23:15:07Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nThe Microsoft Graph Core PHP SDK published packages which contained test code that enabled the use of the phpInfo() function from any application that could access and execute the file at vendor/microsoft/microsoft-graph-core/tests/GetPhpInfo.php.  The phpInfo function exposes system information. \n\nThe vulnerability affects the GetPhpInfo.php script of the PHP SDK which contains a call to the phpinfo() function.  \n\nThis vulnerability requires a misconfiguration of the server to be present so it can be exploited. For example, making the PHP application\u2019s /vendor directory web accessible.  \n\nThe combination of the vulnerability and the server misconfiguration would allow an attacker to craft an HTTP request that executes the phpinfo() method. The attacker would then be able to get access to system information like configuration, modules, and environment variables and later on use the compromised secrets to access additional data.\n\n### Patches\n\nThis problem has been patched in version 2.0.2.\n\n### Workarounds\n\nIf an immediate deployment with the updated vendor package is not available, you can perform the following temporary workarounds:\n- delete the vendor/microsoft/microsoft-graph-core/tests/GetPhpInfo.php file\n- remove access to the /vendor directory will remove this vulnerability\n- disable the phpinfo function\n\n### References\nFor more information about the vulnerability and the patch, users can refer to the following sources: \n\n- https://nvd.nist.gov/vuln/detail/CVE-2023-49103\n- https://github.com/microsoftgraph/msgraph-beta-sdk-php/compare/2.0.0...2.0.1 \n- https://github.com/microsoftgraph/msgraph-sdk-php-core/compare/2.0.1...2.0.2 \n- https://github.com/microsoftgraph/msgraph-sdk-php/compare/1.109.0...1.109.1 \n- https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/ ",
  "id": "GHSA-mhhp-c3cm-2r86",
  "modified": "2024-02-07T16:17:14Z",
  "published": "2023-12-05T22:46:57Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/microsoftgraph/msgraph-sdk-php-core/security/advisories/GHSA-mhhp-c3cm-2r86"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49103"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49283"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/microsoft/microsoft-graph-core/CVE-2023-49283.yaml"
    },
    {
      "type": "WEB",
      "url": "https://github.com/microsoftgraph/msgraph-beta-sdk-php/compare/2.0.0...2.0.1"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/microsoftgraph/msgraph-sdk-php-core"
    },
    {
      "type": "WEB",
      "url": "https://github.com/microsoftgraph/msgraph-sdk-php-core/compare/2.0.1...2.0.2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/microsoftgraph/msgraph-sdk-php/compare/1.109.0...1.109.1"
    },
    {
      "type": "WEB",
      "url": "https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Test code in published microsoft-graph-core package exposes phpinfo()"
}

GSD-2023-49283

Vulnerability from gsd - Updated: 2023-12-13 01:20

Details

Aliases

CVE-2023-49283

Aliases

CVE-2023-49283

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2023-49283",
    "id": "GSD-2023-49283"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-49283"
      ],
      "details": "microsoft-graph-core the Microsoft Graph Library for PHP. The Microsoft Graph Beta PHP SDK published packages which contained test code that enabled the use of the phpInfo() function from any application that could access and execute the file at `vendor/microsoft/microsoft-graph-core/tests/GetPhpInfo.php`. The phpInfo function exposes system information. The vulnerability affects the GetPhpInfo.php script of the PHP SDK which contains a call to the phpinfo() function. This vulnerability requires a misconfiguration of the server to be present so it can be exploited. For example, making the PHP application\u2019s /vendor directory web accessible. The combination of the vulnerability and the server misconfiguration would allow an attacker to craft an HTTP request that executes the phpinfo() method. The attacker would then be able to get access to system information like configuration, modules, and environment variables and later on use the compromised secrets to access additional data. This problem has been patched in version 2.0.2. If an immediate deployment with the updated vendor package is not available, you can perform the following temporary workarounds: delete the `vendor/microsoft/microsoft-graph-core/tests/GetPhpInfo.php` file, remove access to the /vendor directory, or disable the phpinfo function\n",
      "id": "GSD-2023-49283",
      "modified": "2023-12-13T01:20:35.306811Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2023-49283",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "msgraph-sdk-php-core",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "\u003c 2.0.2"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "microsoftgraph"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "microsoft-graph-core the Microsoft Graph Library for PHP. The Microsoft Graph Beta PHP SDK published packages which contained test code that enabled the use of the phpInfo() function from any application that could access and execute the file at `vendor/microsoft/microsoft-graph-core/tests/GetPhpInfo.php`. The phpInfo function exposes system information. The vulnerability affects the GetPhpInfo.php script of the PHP SDK which contains a call to the phpinfo() function. This vulnerability requires a misconfiguration of the server to be present so it can be exploited. For example, making the PHP application\u2019s /vendor directory web accessible. The combination of the vulnerability and the server misconfiguration would allow an attacker to craft an HTTP request that executes the phpinfo() method. The attacker would then be able to get access to system information like configuration, modules, and environment variables and later on use the compromised secrets to access additional data. This problem has been patched in version 2.0.2. If an immediate deployment with the updated vendor package is not available, you can perform the following temporary workarounds: delete the `vendor/microsoft/microsoft-graph-core/tests/GetPhpInfo.php` file, remove access to the /vendor directory, or disable the phpinfo function\n"
          }
        ]
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-200",
                "lang": "eng",
                "value": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/microsoftgraph/msgraph-sdk-php-core/security/advisories/GHSA-mhhp-c3cm-2r86",
            "refsource": "MISC",
            "url": "https://github.com/microsoftgraph/msgraph-sdk-php-core/security/advisories/GHSA-mhhp-c3cm-2r86"
          },
          {
            "name": "https://github.com/microsoftgraph/msgraph-beta-sdk-php/compare/2.0.0...2.0.1",
            "refsource": "MISC",
            "url": "https://github.com/microsoftgraph/msgraph-beta-sdk-php/compare/2.0.0...2.0.1"
          },
          {
            "name": "https://github.com/microsoftgraph/msgraph-sdk-php-core/compare/2.0.1...2.0.2",
            "refsource": "MISC",
            "url": "https://github.com/microsoftgraph/msgraph-sdk-php-core/compare/2.0.1...2.0.2"
          },
          {
            "name": "https://github.com/microsoftgraph/msgraph-sdk-php/compare/1.109.0...1.109.1",
            "refsource": "MISC",
            "url": "https://github.com/microsoftgraph/msgraph-sdk-php/compare/1.109.0...1.109.1"
          },
          {
            "name": "https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/",
            "refsource": "MISC",
            "url": "https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-mhhp-c3cm-2r86",
        "discovery": "UNKNOWN"
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:microsoft:graph:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2.0.2",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2023-49283"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "microsoft-graph-core the Microsoft Graph Library for PHP. The Microsoft Graph Beta PHP SDK published packages which contained test code that enabled the use of the phpInfo() function from any application that could access and execute the file at `vendor/microsoft/microsoft-graph-core/tests/GetPhpInfo.php`. The phpInfo function exposes system information. The vulnerability affects the GetPhpInfo.php script of the PHP SDK which contains a call to the phpinfo() function. This vulnerability requires a misconfiguration of the server to be present so it can be exploited. For example, making the PHP application\u2019s /vendor directory web accessible. The combination of the vulnerability and the server misconfiguration would allow an attacker to craft an HTTP request that executes the phpinfo() method. The attacker would then be able to get access to system information like configuration, modules, and environment variables and later on use the compromised secrets to access additional data. This problem has been patched in version 2.0.2. If an immediate deployment with the updated vendor package is not available, you can perform the following temporary workarounds: delete the `vendor/microsoft/microsoft-graph-core/tests/GetPhpInfo.php` file, remove access to the /vendor directory, or disable the phpinfo function\n"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "NVD-CWE-noinfo"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/microsoftgraph/msgraph-sdk-php-core/security/advisories/GHSA-mhhp-c3cm-2r86",
              "refsource": "",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "https://github.com/microsoftgraph/msgraph-sdk-php-core/security/advisories/GHSA-mhhp-c3cm-2r86"
            },
            {
              "name": "https://github.com/microsoftgraph/msgraph-beta-sdk-php/compare/2.0.0...2.0.1",
              "refsource": "",
              "tags": [
                "Patch"
              ],
              "url": "https://github.com/microsoftgraph/msgraph-beta-sdk-php/compare/2.0.0...2.0.1"
            },
            {
              "name": "https://github.com/microsoftgraph/msgraph-sdk-php-core/compare/2.0.1...2.0.2",
              "refsource": "",
              "tags": [
                "Patch"
              ],
              "url": "https://github.com/microsoftgraph/msgraph-sdk-php-core/compare/2.0.1...2.0.2"
            },
            {
              "name": "https://github.com/microsoftgraph/msgraph-sdk-php/compare/1.109.0...1.109.1",
              "refsource": "",
              "tags": [
                "Patch"
              ],
              "url": "https://github.com/microsoftgraph/msgraph-sdk-php/compare/1.109.0...1.109.1"
            },
            {
              "name": "https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/",
              "refsource": "",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 1.4
        }
      },
      "lastModifiedDate": "2023-12-12T13:24Z",
      "publishedDate": "2023-12-05T23:15Z"
    }
  }
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2023-49283 (GCVE-0-2023-49283)

FKIE_CVE-2023-49283

GHSA-MHHP-C3CM-2R86

Impact

Patches

Workarounds

References

GSD-2023-49283

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour