CVE-2020-7063
Medium
Description
In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when creating PHAR archive using PharData::buildFromIterator() function, the files are added with default permissions (0666, or all access) even if the original files on the filesystem were with more restrictive permissions. This may result in files having more lax permissions than intended when such archive is extracted.
SeverityMedium
CVSS5.5
Exploit probability—
Product
Php
PublishedFeb 27, 2020
First seenFeb 27, 2020
Weakness typeCWE-281CWE-281
How to fix
Update
- tenable tenable.sc5.19.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| php php | 7.2.0 ≤ v ≤ 7.2.27, 7.3.0 ≤ v ≤ 7.3.14, 7.4.0 ≤ v ≤ 7.4.2 | — |
| tenable tenable.sc | v < 5.19.0 | 5.19.0 |
| debian debian_linux | 8.0, 9.0, 10.0 | — |
| opensuse leap | 15.1 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.