Firebase Admin Sdk For Php
Approved changes feed: RSS · Atom
cpe:2.3:a:firebase_admin_sdk_for_php_project:firebase_admin_sdk_for_php:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Firebase Admin Sdk For Php Project (a26391ca-a002-5d64-b10f-d5f79b82b958) |
|---|---|
| Product | Firebase Admin Sdk For Php (4b8119ad-9731-560d-a6ae-8a8776ce4715) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:composer/kreait/firebase-php |
purl2cpe | 2026-06-01 10:11:49.797106 |
pkg:github/kreait/firebase-php |
purl2cpe | 2026-06-01 10:11:49.797107 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-4128 |
vulnerable | 2026-06-08 06:50:17.071567 |
CSRF in firebase-tools emulator suite
LOW (2.6)
This vulnerability was a potential CSRF attack. When running the Firebase emulator suite, there is an export endpoint that is used normally to export data from running emulators. If a user was running the emulator and navigated to a malicious website with the exploit on a browser that allowed calls to localhost (ie Chrome before v94), the website could exfiltrate emulator data. We recommend upgrading past version 13.6.0 or commit 068a2b08dc308c7ab4b569617f5fc8821237e3a0 https://github.com/firebase/firebase-tools/commit/068a2b08dc308c7ab4b569617f5fc8821237e3a0
Published: 2024-05-02T13:22:50.829Z
Updated: 2024-08-01T20:33:52.518Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-1000025 |
vulnerable | 2026-06-08 05:10:25.324054 |
Details available
Jerome Gamez Firebase Admin SDK for PHP version from 3.2.0 to 3.8.0 contains a Incorrect Access Control vulnerability in src/Firebase/Auth/IdTokenVerifier.php does not verify for token signature that can result in JWT with any email address and user ID could be forged from an actual token, or from thin air. This attack appear to be exploitable via Attacker would only need to know email address of the victim on most cases.. This vulnerability appears to have been fixed in 3.8.1.
Published: 2018-02-09T23:00:00.000Z
Updated: 2024-08-05T12:33:49.017Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.