Description

In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 on Windows, PHP link() function accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.

Remediation

References

CVE-2019-11044

Related Vulnerabilities

MySQL CVE-2021-2212 Vulnerability (CVE-2021-2212)

Apache HTTP Server CVE-2002-0839 Vulnerability (CVE-2002-0839)

WordPress Plugin All-In-One Security (AIOS)-Security and Firewall Cross-Site Request Forgery (4.4.3)

LimeSurvey Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2014-5016)

MySQL CVE-2020-14799 Vulnerability (CVE-2020-14799)

Severity

High

Classification

CVE-2019-11044 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities