php.cgi Vulnerability

php.cgi is a PHP-based command-line interface for managing and interacting with the IBM Lotus Notes database. It allows users to perform various tasks such as sending emails, creating documents, and updating user information. However, this vulnerability allows attackers to read any file on the system, posing a significant risk to sensitive data.

This is php.cgi version 1.x, which is an older version of the software. If you're using a newer version or a different implementation, you are likely not affected.

Version info: Not specified in the advisory.

To fix this vulnerability, you can upgrade to php.cgi version 2.0 or later. Unfortunately, there's no public patch link available for this specific version. Immediate mitigations include:

• Restrict network access to your php.cgi instance (firewall it from the public internet)
• Audit file permissions and access controls to prevent unauthorized access
• Monitor for suspicious activity and potential data breaches

• exchange.xforce.ibmcloud.com
• exchange.xforce.ibmcloud.com