Description

Phpfastcache exposes phpinfo() if the "/vendor" directory is not protected from public access. It discloses sensitive information and an attacker could use it to conduct further attacks.

Remediation

Upgrade to the latest version of Phpfastcache

References

Exposed phpinfo() leaked via documentation files (CVE-2021-37704)

Related Vulnerabilities

Struts 2 Config Browser plugin enabled

Symfony running in dev mode

WordPress 5.2.x Multiple Vulnerabilities (5.2 - 5.2.18)

WordPress Plugin Fast Velocity Minify Information Disclosure (2.7.6)

WordPress Plugin U BuddyPress Forum Attachment 'fileurl' Parameter Remote File Disclosure (1.1.1)

Severity

Medium

Classification

CVE-2021-37704 CWE-200 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Configuration Information Disclosure