Description

When using fgetss() function to read data with stripping tags, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause this function to read past the allocated buffer. This may lead to information disclosure or crash.

Remediation

References

CVE-2020-7059

Related Vulnerabilities

WordPress Plugin MM Forms Community 'edit_details.php' SQL Injection (1.2.3)

MySQL CVE-2012-0119 Vulnerability (CVE-2012-0119)

WordPress Plugin Thinkun Remind 'dirPath' Parameter Information Disclosure (1.1.3)

WordPress Plugin Stylish Price List Security Bypass (6.9.0)

PHP Improper Input Validation Vulnerability (CVE-2004-1019)

Severity

Critical

Classification

CVE-2020-7059 CWE-125 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

Tags

Missing Update Known Vulnerabilities