CVE-2023-49282
1 advisory.
Packagist/microsoft/microsoft-graph CVE-2023-49282: medium 5.4, EPSS 2.20%
Test code in published microsoft-graph package exposes phpinfo()
Action: Upgrade microsoft/microsoft-graph to 1.109.1 or later.
composer require microsoft/microsoft-graph:1.109.1composer require microsoft/microsoft-graph:2.0.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.16.0 | 1.109.1 | - |
| 2.0.0-RC1 | 2.0.1 | - |
Fixed versions
| 1.109.1 | 2.0.1 |
Sources
- osv: GHSA-cgwq-6prq-8h9q
- https://github.com/microsoftgraph/msgraph-sdk-php/security/advisories/GHSA-cgwq-6prq-8h9q
- https://nvd.nist.gov/vuln/detail/CVE-2023-49282
- https://github.com/FriendsOfPHP/security-advisories/blob/master/microsoft/microsoft-graph/CVE-2023-49282.yaml
- https://github.com/microsoftgraph/msgraph-beta-sdk-php/compare/2.0.0...2.0.1
- https://github.com/microsoftgraph/msgraph-sdk-php
- https://github.com/microsoftgraph/msgraph-sdk-php-core/compare/2.0.1...2.0.2
- https://github.com/microsoftgraph/msgraph-sdk-php/compare/1.109.0...1.109.1
- https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments
CVE-2023-49282 · published · modified · JSON