{"id":"GHSA-hpj2-4hfj-g233","aliases":["CVE-2020-5203"],"title":"Fat-Free Framework arbitrary code execution","description":"In Fat-Free Framework 3.7.1, attackers can achieve arbitrary code execution if developers choose to pass user controlled input (e.g., `$_REQUEST`, `$_GET`, or `$_POST`) to the framework's Clear method.","severity":"critical","score":9.8,"published":"2022-05-24T17:10:47.000Z","modified":"2024-04-25T21:43:28.074Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"bcosca/fatfree","ranges":[{"events":[{"introduced":"0"},{"fixed":"3.7.2"}],"type":"ECOSYSTEM"}],"versions":["3.1.1","3.1.2","3.2.0","3.2.1","3.2.2","3.3.0","3.4.0","3.5.0","3.5.1","3.6.0","3.6.1","3.6.2","3.6.3","3.6.4","3.6.5","3.7.0","3.7.1"],"fixed":["3.7.2"]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2020-5203","https://github.com/bcosca/fatfree-core/commit/dae95a0baf3963a9ef87c17cee52f78f77e21829","https://github.com/bcosca/fatfree","https://github.com/bcosca/fatfree/releases"],"sources":[{"name":"OSV","id":"GHSA-hpj2-4hfj-g233","modified":"2024-04-25T21:43:28.074981Z","url":"https://osv.dev/vulnerability/GHSA-hpj2-4hfj-g233"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8}]}