CVE-2019-11045

DirectoryIterator class silently truncates after a null byte

In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.

We have discovered 390,801 live websites that are affected by CVE-2019-11045.

Test my site



Affected Software

Product  PHP
Category Programming Languages
Vulnerable Domains390,801 live websites (4.48% of PHP install base)
Vulnerable Versions
  • from 7.2 before 7.2.26
  • from 7.3 before 7.3.13
  • from 7.4 before 7.4.1
Vulnerable Versions Count40 versions ( 7.31% of all versions)


Common Weakness Enumeration

CWE-170 Improper Null Termination



Details

  • Published - Dec 23, 2019
  • Updated - Sep 16, 2024

Credits

  • Submitted by ryat at php.net

CVE-2019-11045 usage by Country

United States143,557 websites


France176,164 websites
China11,020 websites
Germany8,316 websites
Russia7,655 websites
Japan3,613 websites
Netherlands3,159 websites
Poland3,083 websites
GB2,941 websites
Italy2,356 websites

CVE-2019-11045 usage by TLD

.com155,444 websites
.fr69,498 websites
.ru59,318 websites
.org14,236 websites
.net10,462 websites
.be8,180 websites
.pl6,563 websites
.de5,184 websites
.it5,022 websites
.eu3,581 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2019-11045

Top websites that are affected by CVE-2019-11045. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*.cn China*,***
*****.***.cn China*,***
*****.cn China*,***
*********.com China*,***
*******.com United States*,***
*****.com United States*,***
******.com United States*,***
***.***.edu United States*,***
****.***.edu United States*,***
***.****.gov United States*,***
See full domain list

FAQ

CVE-2019-11045 is Improper Null Termination in PHP
A total of 390,801 websites have been identified as vulnerable to CVE-2019-11045, discovered through global website indexing conducted by WebTechSurvey.
PHP is susceptible to CVE-2019-11045 vulnerability.
PHP versions before 7.4.1 are vulnerable to CVE-2019-11045.
Version 7.4.1 of PHP addresses the CVE-2019-11045 security vulnerability.

References