PT-2019-5046 · Php+1 · Php+1
Published
2019-12-22
·
Updated
2022-12-14
·
CVE-2019-11044
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
PHP versions 7.2.x through 7.2.25
PHP versions 7.3.x through 7.3.12
PHP version 7.4.0
Description
The issue is related to the link() function in PHP, which accepts filenames with embedded 0 byte and treats them as terminating at that byte. This could lead to security issues, such as in applications checking paths that the code is allowed to access. The vulnerability is associated with insufficient input validation, allowing a remote attacker to gain unauthorized access to information.
Recommendations
For PHP versions 7.2.x through 7.2.25, update to version 7.2.26 or later.
For PHP versions 7.3.x through 7.3.12, update to version 7.3.13 or later.
For PHP version 7.4.0, update to a later version that addresses this issue.
As a temporary workaround, consider restricting the use of the
link() function until a patch is available.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Php