PT-2019-4727 · Php+7 · Php+7
Publicado
2019-12-21
·
Atualizado
2022-12-20
·
CVE-2019-11045
CVSS v3.1
5.9
Média
| Vetor | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
PHP versions 7.2.x through 7.2.25
PHP versions 7.3.x through 7.3.12
PHP version 7.4.0
Description
The issue arises from the PHP DirectoryIterator class accepting filenames with embedded 0 byte and treating them as terminating at that byte. This could lead to security issues, such as in applications checking paths that the code is allowed to access. The vulnerability is due to insufficient input validation in the PHP DirectoryIterator class implementation, which may allow a remote attacker to disclose protected information.
Recommendations
For PHP version 7.2.x, update to version 7.2.26 or later.
For PHP version 7.3.x, update to version 7.3.13 or later.
For PHP version 7.4.0, update to a version later than 7.4.0.
As a temporary workaround, consider restricting the use of the DirectoryIterator class until a patch is available.
Exploit
Correção
Special Elements Injection
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Almalinux
Centos
Php
Red Hat
Rocky Linux
Suse
Ubuntu