Detections
Analytics

Echo: php-7.2: security update to 7.2.34+e1

high Tenable Cloud Security Plugin ID 477445

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In PHP versions 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8 various XML functions
 rely on libxml global state to track configuration variables, like whether external entities are loaded.
 This state is assumed to be unchanged unless the user explicitly changes it by calling appropriate
 function. However, since the state is process-global, other modules - such as ImageMagick - may also use
 this library within the same process, and change that global state for their internal purposes, and leave
 it in a state where external entities loading is enabled. This can lead to the situation where external
 XML is parsed with external entities loaded, which can lead to disclosure of any local files accessible to
 PHP. This vulnerable state may persist in the same process across many requests, until the process is shut
 down. (CVE-2023-3823)

Solution

Update the php-7.2 library and its related packages to version 7.2.34+e1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2023-3823

Plugin Details

Severity: High

ID: 477445

Version: Revision 1.1

Type: Local

Published: 10/25/2026

Updated: 10/25/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2023-3823

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/25/2026

Vulnerability Publication Date: 8/2/2023

Reference Information

CVE: CVE-2023-3823