Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this vulnerability if their php.ini configuration has `register_argc_argv` enabled. For these users an unspecified remote code execution vector is present. Users are advised to update to version 3.9.14, 4.13.2, or 5.5.2. Users unable to upgrade should disable `register_argc_argv` to mitigate the issue.

The version of CraftCMS installed on the remote host is vulnerable to a Remote Code Execution (RCE) via a specially forged request when the register_argc_argv php option is enabled.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond.
    Users of affected versions are affected by this vulnerability if their php.ini configuration has
    `register_argc_argv` enabled. For these users an unspecified remote code execution vector is present.
    Users are advised to update to version 3.9.14, 4.13.2, or 5.5.2. Users unable to upgrade should disable
    `register_argc_argv` to mitigate the issue. (CVE-2024-56145)

ID	Name	Product	Family	Severity
114614	CraftCMS < 4.13.2 / 5.x < 5.5.2 Remote Code Execution	Web App Scanning	Component Vulnerability	critical
409006	SCA: security update for craftcms/cms (GHSA-2p6p-9rc9-62j9)	Tenable Cloud Security	SCA Checks	critical
409006	SCA: security update for craftcms/cms (GHSA-2p6p-9rc9-62j9)	Tenable Self-Hosted Container Security	SCA Checks	critical

Detections

Analytics

CVE-2024-56145

critical

Tenable Plugins

critical

critical

critical