In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.

References[email protected]/message/3W23TP6X4H7LB645FYZLUPNIRD5W3EPU/[email protected]/message/FSNBUSPKMLUHHOADROKNG5GDWDCRHT5M/[email protected]/message/T62LF4ZWVV7OMMIZFO6IFO5QLZKK7YRD/


Source: MITRE

Published: 2019-10-28

Updated: 2020-08-18

Type: CWE-787

Risk Information

CVSS v2.0

Base Score: 7.5

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Impact Score: 6.4

Exploitability Score: 10

Severity: HIGH

CVSS v3.0

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Impact Score: 5.9

Exploitability Score: 3.9

Severity: CRITICAL