What’s Vulnerable › Vulnerabilities

CVE-2024-2054: Artica Proxy Unauthenticated PHP Deserialization Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 81.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-03-21 · updated 2026-06-17
• Weakness: CWE-502

Description

The Artica-Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the "www-data" user.

Affected products

• Artica Tech Artica Proxy: 4.50.000000

References

• http://seclists.org/fulldisclosure/2024/Mar/12
• https://korelogic.com/Resources/Advisories/KL-001-2024-002.txt
• http://seclists.org/fulldisclosure/2024/Mar/12
• https://korelogic.com/Resources/Advisories/KL-001-2024-002.txt

Get alerted when CVE-2024-2054 or the next vulnerability affects your stack