| |
Vulnerability CVE-2020-7067
Published: 2020-04-27
| Description: |
In PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17 and 7.4.x below 7.4.5, if PHP is compiled with EBCDIC support (uncommon), urldecode() function can be made to access locations past the allocated memory, due to erroneously using signed numbers as array indexes. |
Type:
CWE-125 (Out-of-bounds Read)
CVSS2 => (AV:N/AC:L/Au:N/C:P/I:N/A:N)
| CVSS Base Score |
Impact Subscore |
Exploitability Subscore |
5/10 |
2.9/10 |
10/10 |
| Exploit range |
Attack complexity |
Authentication |
Remote |
Low |
No required |
| Confidentiality impact |
Integrity impact |
Availability impact |
Partial |
None |
None |
References: |
https://bugs.php.net/bug.php?id=79465
https://security.netapp.com/advisory/ntap-20200504-0001/
|
|
|
Copyright 2024, cxsecurity.com
|
|
|
