CVE-2024-28864[TagAwareCipher] - Decryption Failure (Regex Match)
- 2.6LowCVSS base score
- 0.33%Exploitation in 30 daysEPSS · top 74% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
SecureProps is a PHP library designed to simplify the encryption and decryption of property data in objects. A vulnerability in SecureProps version 1.2.0 and 1.2.1 involves a regex failing to detect tags during decryption of encrypted data. This occurs when the encrypted data has been encoded with `NullEncoder` and passed to `TagAwareCipher`, and contains special characters such as `\n`. As a result, the decryption process is skipped since the tags are not detected. This causes the encrypted data to be returned in plain format. The vulnerability affects users who implement `TagAwareCipher` with any base cipher that has `NullEncoder` (not default). The patch for the issue has been released. Users are advised to update to version 1.2.2. As a workaround, one may use the default `Base64Encoder` with the base cipher decorated with `TagAwareCipher` to prevent special characters in the encrypted string from interfering with regex tag detection logic. This workaround is safe but may involve double encoding since `TagAwareCipher` uses `NullEncoder` by default.
Timeline
ID reserved
By GitHub_M
- 7 days later
· 7 days later
Published
- 5 months later
· 5 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | Low2.6 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N |
| NVDNVD · Analyzed | 3.1 | Low2.6 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N |
- EPSS (exploitation in 30 days)
- 0.33% · top 74% of all CVEs (14 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 2.6.
Affected products
- affected >= 1.2.0, < 1.2.2
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Packagistilicmiljan/secure-propsGHSA-rj29-j2g4-77q8 (opens in a new tab)
References
References4
- https://github.com/IlicMiljan/Secure-Props/security/advisories/GHSA-rj29-j2g4-77q8 (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://github.com/IlicMiljan/Secure-Props/issues/20 (opens in a new tab)x_refsource_MISCx_transferred
- https://github.com/IlicMiljan/Secure-Props/pull/21 (opens in a new tab)x_refsource_MISCx_transferred
- https://github.com/IlicMiljan/Secure-Props/commit/ab7b561040cd37fda3dbf9a6cab01fefcaa16627 (opens in a new tab)x_refsource_MISCx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2024-1003 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-rj29-j2g4-77q8 (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2024-28864)Record last updated .