Lucene search

PhpCVE-2020-7066

HistoryApr 01, 2020 - 4:15 a.m.

CVE-2020-7066

2020-04-0104:15:14

CWE-170

php

web.nvd.nist.gov

583

cve-2020-7066

php

get_headers()

url truncation

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

6.2

Confidence

Low

EPSS

0.004

Percentile

74.8%

JSON

In PHP versions 7.2.x below 7.2.29, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using get_headers() with user-supplied URL, if the URL contains zero (\0) character, the URL will be silently truncated at it. This may cause some software to make incorrect assumptions about the target of the get_headers() and possibly send some information to a wrong server.

Affected configurations

Nvd

Node

phpphpRange7.2.0–7.2.29

phpphpRange7.3.0–7.3.16

phpphpRange7.4.0–7.4.4

Node

tenabletenable.scRange<5.19.0

tenabletenable.scMatch5.19.0

Node

opensuseleapMatch15.1

Node

debiandebian_linuxMatch8.0

debiandebian_linuxMatch9.0

debiandebian_linuxMatch10.0

CNA Affected

[
  {
    "product": "PHP",
    "vendor": "PHP Group",
    "versions": [
      {
        "status": "affected",
        "version": "7.2.x below 7.2.29"
      },
      {
        "status": "affected",
        "version": "7.3.x below 7.3.16"
      },
      {
        "status": "affected",
        "version": "7.4.x below 7.4.4"
      }
    ]
  }
]