CVE-2019-11044
link() silently truncates after a null byte on Windows
Severity Score
7.5
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
1
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 on Windows, PHP link() function accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.
En PHP versiones 7.2.x por debajo de 7.2.26, versiones 7.3.x por debajo de 7.3.13 y 7.4.0 en Windows, la función PHP link() acepta nombres de archivo con /0 byte insertado y los trata como terminando en ese byte. Esto podría conllevar a vulnerabilidades de seguridad, por ejemplo en aplicaciones que comprueban las rutas a las que se permite acceder al código.
*Credits:
Submitted by ryat at php.net
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2019-04-09 CVE Reserved
- 2019-12-23 CVE Published
- 2023-11-08 EPSS Updated
- 2024-09-17 CVE Updated
- 2024-09-17 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-170: Improper Null Termination
CAPEC
References (5)
URL | Tag | Source |
---|---|---|
https://security.netapp.com/advisory/ntap-20200103-0002 | Third Party Advisory | |
https://www.tenable.com/security/tns-2021-14 | Third Party Advisory |
URL | Date | SRC |
---|---|---|
https://bugs.php.net/bug.php?id=78862 | 2024-09-17 |
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | >= 7.2.0 <= 7.2.26 Search vendor "Php" for product "Php" and version " >= 7.2.0 <= 7.2.26" | - |
Affected
| ||||||
Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | >= 7.3.0 <= 7.3.13 Search vendor "Php" for product "Php" and version " >= 7.3.0 <= 7.3.13" | - |
Affected
| ||||||
Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | 7.4.0 Search vendor "Php" for product "Php" and version "7.4.0" | - |
Affected
| ||||||
Tenable Search vendor "Tenable" | Securitycenter Search vendor "Tenable" for product "Securitycenter" | < 5.19.0 Search vendor "Tenable" for product "Securitycenter" and version " < 5.19.0" | - |
Affected
| ||||||
Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 30 Search vendor "Fedoraproject" for product "Fedora" and version "30" | - |
Affected
| ||||||
Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 31 Search vendor "Fedoraproject" for product "Fedora" and version "31" | - |
Affected
|