Craft CMS · Craft CMS
CVE-2024-56145
RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms
De quoi s'agit-il
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this vulnerability if their php.ini configuration has `register_argc_argv` enabled. For these users an unspecified remote code execution vector is present. Users are advised to update to version 3.9.14, 4.13.2, or 5.5.2. Users unable to upgrade should disable `register_argc_argv` to mitigate the issue.
CISA: Craft CMS contains a code injection vulnerability. Users with affected versions are vulnerable to remote code execution if their php.ini configuration has `register_argc_argv` enabled.
Que faire
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Échéance pour les agences fédérales américaines : 23 juin 2025
Autres failles exploitées chez Craft CMS
| Ajouté | Faille | Produit | Gravité | Risque d'attaque |
|---|---|---|---|---|
| 20 mars 2026 | Code Injection | Craft CMS | Critique 10,0 | 99,8% |
| 2 juin 2025 | External Control of Assumed-Immutable Web Parameter | Craft CMS | Moyenne 6,9 | 1,3% |
| 20 févr. 2025 | Code Injection | Craft CMS | Élevé 8,1 | 22% |
Sources : Known Exploited Vulnerabilities (CISA, domaine public), CVE records (cve.org) et EPSS (FIRST). Le risque d'attaque est l'estimation EPSS qu'une personne tente d'exploiter la faille dans les 30 prochains jours.