SynopsisThe version of PHP running on the remote web server is affected by a denial of service vulnerability
DescriptionAccording to its self-reported version number, the version of PHP running on the remote web server is 7.2.x prior to 7.2.31, 7.3.x prior to 7.3.18 or 7.4.x prior to 7.4.6. It is, therefore, affected by a denial of service (DoS) vulnerability in its HTTP file upload component due to a failure to clean up temporary files created during the file upload process. An unauthenticated, remote attacker can exploit this issue, by repeatedly submitting uploads with long file or field names, to exhaust disk space and cause a DoS condition.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
SolutionUpgrade to PHP version 7.2.31, 7.3.18, 7.4.6 or later.