CVE-2019-9637: High severity PHP PHP vulnerability
An issue was discovered in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. Due to the way rename() across filesystems is implemented, it is possible that file being renamed is briefly available with wrong permissions while the rename is ongoing, thus enabling unauthorized users to access the data.
Other sources
Fixed bug (rename() across the device may allow unwanted access during processing). (CVE-2019-9637)
— PHP
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID of this bug?
The vulnerability ID of this bug is CVE-2019-9637.
What is the severity level of CVE-2019-9637?
The severity level of CVE-2019-9637 is high.
What is the affected software version range for CVE-2019-9637?
The affected software versions for CVE-2019-9637 are PHP 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3.
How does CVE-2019-9637 allow unauthorized access?
CVE-2019-9637 allows unauthorized access by briefly making the renamed file available with wrong permissions.
Where can I find more information about CVE-2019-9637?
You can find more information about CVE-2019-9637 at the following references: - [https://www.php.net/ChangeLog-7.php#7.1.27](https://www.php.net/ChangeLog-7.php#7.1.27) - [https://bugs.php.net/bug.php?id=77630](https://bugs.php.net/bug.php?id=77630) - [http://git.php.net/?p=php-src.git;a=commit;h=e3133e4db70476fb7adfdedb738483e2255ce0e1](http://git.php.net/?p=php-src.git;a=commit;h=e3133e4db70476fb7adfdedb738483e2255ce0e1)