CVE-2014-1999 The auto-format feature in the Request_Curl class in FuelPHP 1.1 through 1.7.1 allows remote attackers to execute arbitrary code via a crafted response.
HighCVSS 7.5
EPSS 2.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The auto-format feature in the Request_Curl class in FuelPHP 1.1 through 1.7.1 allows remote attackers to execute arbitrary code via a crafted response.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fuelphp | = 1.1 | No fix listed |
| fuelphp | = 1.2 | No fix listed |
| fuelphp | = 1.2-rc1 | No fix listed |
| fuelphp | = 1.2.1 | No fix listed |
| fuelphp | = 1.3 | No fix listed |
| fuelphp | = 1.4 | No fix listed |
| fuelphp | = 1.5 | No fix listed |
| fuelphp | = 1.5.1 | No fix listed |
| fuelphp | = 1.5.2 | No fix listed |
| fuelphp | = 1.5.3 | No fix listed |
| fuelphp | = 1.6 | No fix listed |
| fuelphp | = 1.6.1 | No fix listed |
| fuelphp | = 1.7 | No fix listed |
| fuelphp | = 1.7.1 | No fix listed |
References
- fuelphp.com vendor-advisory
- JVN#94791545 third-party-advisory vendor-advisory
- JVNDB-2014-000082 third-party-advisory vendor-advisory