CVE-2021-37704
MEDIUM NUCLEIPhpfastcache < 6.1.5 - Information Disclosure
Title source: ruleDescription
PhpFastCache is a high-performance backend cache system (packagist package phpfastcache/phpfastcache). In versions before 6.1.5, 7.1.2, and 8.0.7 the `phpinfo()` can be exposed if the `/vendor` is not protected from public access. This is a rare situation today since the vendor directory is often located outside the web directory or protected via server rule (.htaccess, etc). Only the v6, v7 and v8 will be patched respectively in 8.0.7, 7.1.2, 6.1.5. Older versions such as v5, v4 are not longer supported and will **NOT** be patched. As a workaround, protect the `/vendor` directory from public access.
Nuclei Templates (1)
phpfastcache - phpinfo Resource Exposure
MEDIUMby whoever
Scores
CVSS v3
5.4
EPSS
0.4780
EPSS Percentile
97.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Classification
CWE
CWE-200
CWE-668
Status
published
Affected Products (2)
phpfastcache/phpfastcache
< 6.1.5
phpfastcache/phpfastcache
< 6.1.5Packagist
Timeline
Published
Aug 12, 2021
Tracked Since
Feb 18, 2026