Description

In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 on Windows, PHP link() function accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.

Remediation

References

CVE-2019-11044

Related Vulnerabilities

MySQL CVE-2021-2001 Vulnerability (CVE-2021-2001)

PostgreSQL Improper Authentication Vulnerability (CVE-2009-3231)

Atlassian Jira CVE-2020-36237 Vulnerability (CVE-2020-36237)

WordPress Plugin Registration Forms-User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction Security Bypass (3.8.1.2)

Chamilo Improper Neutralization of Special Elements used in a Command ('Command Injection') Vulnerability (CVE-2023-34960)

Severity

High

Classification

CVE-2019-11044 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities