CVE-2020-7062CWE-476

Null Pointer Dereference in PHP Session Upload Progress

High · published February 27, 2020

CVSS v3.1
7.5
EPSS
4%
Percentile
89.4
In the wild
Unconfirmed
What it is

In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when using file upload functionality, if upload progress tracking is enabled, but session.upload_progress.cleanup is set to 0 (disabled), and the file upload fails, the upload procedure would try to clean up data that does not exist and encounter null pointer dereference, which would likely lead to a crash.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.03581 · 89.4th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2020-02-27T20:25Z
EPSS history
Timeline
  • 27 FEB 20:25Z
    Null Pointer Dereference in PHP Session Upload Progress
    cvelistv5