CVE-2021-37704
Description
PhpFastCache is a high-performance backend cache system (packagist package phpfastcache/phpfastcache). In versions before 6.1.5, 7.1.2, and 8.0.7 the `phpinfo()` can be exposed if the `/vendor` is not protected from public access. This is a rare situation today since the vendor directory is often located outside the web directory or protected via server rule (.htaccess, etc). Only the v6, v7 and v8 will be patched respectively in 8.0.7, 7.1.2, 6.1.5. Older versions such as v5, v4 are not longer supported and will **NOT** be patched. As a workaround, protect the `/vendor` directory from public access.
How to fix
- phpfastcache phpfastcache6.1.5, 7.1.2, 8.0.7 or later
- phpfastcache/phpfastcache6.1.5, 7.1.2, 8.0.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| phpfastcache phpfastcache | v < 6.1.5, 7.0.0 ≤ v < 7.1.2, 8.0.0 ≤ v < 8.0.7 | 6.1.5, 7.1.2, 8.0.7 |
| phpfastcache/phpfastcachePackagist | v < 6.1.5, 7.0.0 ≤ v < 7.1.2, 8.0.0 ≤ v < 8.0.7 | 6.1.5, 7.1.2, 8.0.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.