CVE-2020-7066CWE-170

get_headers() silently truncates after a null byte

Medium · published April 1, 2020

CVSS v3.1
5.3
EPSS
3%
Percentile
86.2
In the wild
Unconfirmed
What it is

In PHP versions 7.2.x below 7.2.29, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using get_headers() with user-supplied URL, if the URL contains zero (\0) character, the URL will be silently truncated at it. This may cause some software to make incorrect assumptions about the target of the get_headers() and possibly send some information to a wrong server.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.02767 · 86.2th percentile
Weakness
CWE-170 · Improper Null Termination
Published
2020-04-01T03:35Z
EPSS history
Timeline
  • 01 APR 03:35Z
    get_headers() silently truncates after a null byte
    cvelistv5